Authentication Methods

VeraID supports multiple authentication methods that can be enabled, disabled, and configured per organization. Users can enroll in multiple methods and use any enabled method to sign in. Conditional access policies can require specific methods for high-risk scenarios.

Overview

Method	Type	MFA Support	Phishing Resistant
Password + TOTP	Knowledge + Possession	Built-in (TOTP is the second factor)	No
Passkeys / WebAuthn	Possession + Biometric	Built-in (single gesture)	Yes
Magic Links	Possession (email)	Optional (can require TOTP after click)	No
Social Login	Delegated	Depends on provider	Depends on provider

---

Password + TOTP MFA

The classic username and password flow with time-based one-time password (TOTP) as a second factor.

Password policy

Configure password requirements for your organization:

curl -X PUT https://app.veraid.io/api/v1/auth/password-policy \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "minLength": 12,
    "requireUppercase": true,
    "requireLowercase": true,
    "requireNumbers": true,
    "requireSpecialChars": true,
    "maxAgeDays": 90,
    "historyCount": 12,
    "lockoutThreshold": 5,
    "lockoutDurationMinutes": 30,
    "breachDetection": true
  }'

Setting	Default	Description
minLength	12	Minimum password length
requireUppercase	true	Require at least one uppercase letter
requireLowercase	true	Require at least one lowercase letter
requireNumbers	true	Require at least one digit
requireSpecialChars	true	Require at least one special character
maxAgeDays	90	Days before password expires (0 = never)
historyCount	12	Number of previous passwords to block from reuse
lockoutThreshold	5	Failed attempts before account lockout
lockoutDurationMinutes	30	Lockout duration (0 = until admin unlock)
breachDetection	true	Check passwords against known breach databases (Have I Been Pwned)

Tip

Enable breachDetection to prevent users from setting passwords that appear in known data breaches. VeraID uses the k-anonymity model — only a partial hash prefix is sent to the breach database, so passwords are never transmitted in cleartext.

TOTP enrollment

When TOTP is required, users are prompted to enroll during their next login:

1. User completes password authentication.
2. VeraID displays a QR code containing the TOTP secret.
3. User scans the QR code with an authenticator app (Google Authenticator, Authy, 1Password, etc.).
4. User enters the current 6-digit code to verify enrollment.
5. VeraID provides recovery codes (8 single-use codes) for account recovery.

TOTP configuration

curl -X PUT https://app.veraid.io/api/v1/auth/totp-config \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "required": true,
    "algorithm": "SHA1",
    "digits": 6,
    "period": 30,
    "window": 1,
    "recoveryCodesCount": 8
  }'

Setting	Default	Description
required	false	Require TOTP for all users (grace period: 7 days after enabling)
algorithm	SHA1	HMAC algorithm (SHA1, SHA256, SHA512)
digits	6	Number of digits in the OTP code
period	30	Code validity period in seconds
window	1	Number of periods to accept before/after current time
recoveryCodesCount	8	Number of one-time recovery codes to generate

---

Passkeys / WebAuthn

Passkeys provide phishing-resistant authentication using platform authenticators (Touch ID, Face ID, Windows Hello) or security keys (YubiKey, Titan). A single biometric gesture replaces both the password and the second factor.

Enabling passkeys

curl -X PUT https://app.veraid.io/api/v1/auth/webauthn-config \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "rpName": "VeraID",
    "rpId": "app.veraid.io",
    "attestation": "none",
    "userVerification": "required",
    "residentKey": "preferred",
    "allowedAuthenticators": ["platform", "cross-platform"]
  }'

Setting	Default	Description
enabled	false	Enable passkey registration and authentication
rpName	”VeraID”	Relying party display name shown to users
rpId	”app.veraid.io”	Relying party ID (must match the domain)
attestation	”none”	Attestation preference: none, indirect, direct
userVerification	”required”	User verification: required, preferred, discouraged
residentKey	”preferred”	Resident key requirement: required, preferred, discouraged
allowedAuthenticators	Both	platform (Touch ID, Windows Hello), cross-platform (YubiKey)

Passkey enrollment

Users can register passkeys from Profile > Security > Passkeys:

1. Click Register Passkey.
2. The browser prompts for biometric verification or security key insertion.
3. Name the passkey (e.g., “MacBook Pro Touch ID”, “Office YubiKey”).
4. The passkey is registered and can be used for future sign-ins.

Users can register multiple passkeys for redundancy. Each passkey is listed with its name, creation date, and last-used timestamp.

Note

Passkeys registered as “platform” authenticators (Touch ID, Windows Hello) are tied to the specific device. For cross-device access, encourage users to register a cross-platform security key or multiple platform passkeys.

---

Magic links

Magic link authentication sends a one-time sign-in link to the user’s verified email address. No password is required.

Configuration

curl -X PUT https://app.veraid.io/api/v1/auth/magic-link-config \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "enabled": true,
    "ttlMinutes": 10,
    "maxAttempts": 3,
    "requireMfaAfterClick": false,
    "allowedDomains": ["example.com", "company.com"],
    "emailTemplate": "default"
  }'

Setting	Default	Description
enabled	false	Enable magic link sign-in
ttlMinutes	10	Link validity period
maxAttempts	3	Maximum magic link requests per hour per email
requireMfaAfterClick	false	Require TOTP verification after clicking the magic link
allowedDomains	All verified domains	Restrict magic links to specific email domains
emailTemplate	”default”	Email template ID for the magic link message

Flow

1. User enters their email address on the sign-in page.
2. VeraID sends a one-time link to the email address.
3. User clicks the link within the TTL window.
4. VeraID validates the token and creates a session.
5. (Optional) If requireMfaAfterClick is enabled, user must enter a TOTP code.

Caution

Magic links are only as secure as the user’s email account. If you require higher assurance, enable requireMfaAfterClick or use conditional access policies to require passkeys for sensitive operations.

---

Social login

VeraID supports delegated authentication via external social and enterprise identity providers. Users can sign in using their existing accounts without creating a VeraID-specific password.

Supported providers

Provider	Protocol	Scopes Requested
Google	OIDC	openid, email, profile
Microsoft	OIDC	openid, email, profile, User.Read
GitHub	OAuth 2.0	read:user, user:email
Apple	OIDC	name, email

Configuring a social provider

1. Navigate to Settings > Identity Provider > Social Login.
2. Click Add Provider and select the provider.
3. Enter the OAuth/OIDC credentials from the provider’s developer console:

curl -X POST https://app.veraid.io/api/v1/auth/social-providers \
  -H "Authorization: Bearer kd_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "provider": "google",
    "clientId": "123456789.apps.googleusercontent.com",
    "clientSecret": "GOCSPX-abc123...",
    "scopes": ["openid", "email", "profile"],
    "domainRestriction": ["example.com"],
    "autoLinkByEmail": true,
    "jitProvisioning": true
  }'

Setting	Description
provider	Provider identifier: google, microsoft, github, apple
clientId	OAuth client ID from the provider’s developer console
clientSecret	OAuth client secret (encrypted at rest)
scopes	OAuth scopes to request during authentication
domainRestriction	Only allow users with email addresses from these domains
autoLinkByEmail	Automatically link social accounts to existing users by matching email
jitProvisioning	Create a VeraID user on first social login if one does not exist

Domain restrictions

Use domainRestriction to limit social login to users with email addresses from your organization’s verified domains. This prevents unauthorized users from signing in with personal accounts:

{
  "domainRestriction": ["example.com", "subsidiary.example.com"]
}

Note

When autoLinkByEmail is enabled, VeraID will automatically link a social login to an existing user account if the email addresses match and the domain is verified. If jitProvisioning is also enabled, a new user account is created when no match is found.

---

Authentication method priority

When multiple methods are enabled, the sign-in page displays them in the following order:

1. Passkeys — Shown first when the user has registered passkeys (browser autofill).
2. Social login — Provider buttons displayed prominently.
3. Magic link — “Sign in with email” option.
4. Password — Traditional email/password form.

You can customize this order in Settings > Identity Provider > Sign-in Experience.

---

Enforcing specific methods

Use conditional access policies to require specific authentication methods based on context:

{
  "name": "Require passkey for admin access",
  "conditions": {
    "roles": ["admin", "super-admin"],
    "applications": ["admin-dashboard"]
  },
  "requirements": {
    "authenticationMethods": ["webauthn"],
    "maxSessionAge": "1h"
  }
}

See Conditional Access for details on creating policies.

---

Next steps

OIDC Provider

Use VeraID as an OIDC identity provider for your applications. OIDC Guide

User Directory

Manage users, groups, and SCIM provisioning. Directory Guide

Conditional Access

Create context-aware policies that enforce specific authentication methods. Conditional Access