Authentication and MFA

Identity supports tenant-local password and email-code authentication, configured upstream providers, tenant federation, TOTP and one-use recovery codes. Tenant and client policy decide which paths are available.

TOTP lifecycle

Enrollment requires fresh primary proof. Accounts without a local password can satisfy that proof through the supported fresh verification path. Replacing or disabling an existing factor requires verification of the current factor or a valid recovery code.

Recovery codes are shown when issued and stored only as password-style hashes. A used recovery code is replaced once; applications must present the replacement to the user through a protected UI.

Credential changes

Password recovery and registration use purpose-separated, tenant-scoped, one-use grants. Completing either operation does not authenticate a session. Credential changes revoke the relevant existing state according to the server policy.

Authentication errors remain deliberately neutral where account enumeration would otherwise be possible. Clients should render the documented outcome instead of inferring whether an email exists.