[{"data":1,"prerenderedAt":1026},["ShallowReactive",2],{"doc-features\u002Fauth":3,"content-query-oQINClMiTY":4},null,{"_path":5,"_dir":6,"_draft":7,"_partial":7,"_locale":8,"title":9,"description":8,"sidebar_position":10,"body":11,"_type":1020,"_id":1021,"_source":1022,"_file":1023,"_stem":1024,"_extension":1025},"\u002Fdocs\u002Ffeatures\u002Fauth","features",false,"","Authentication & Security",1,{"type":12,"children":13,"toc":1009},"root",[14,22,39,45,52,57,319,325,360,365,371,376,423,444,450,455,497,502,541,547,552,607,613,618,632,637,643,648,737,742,789,794,828,834,956,962,1003],{"type":15,"tag":16,"props":17,"children":19},"element","h1",{"id":18},"authentication-security",[20],{"type":21,"value":9},"text",{"type":15,"tag":23,"props":24,"children":29},"div",{"className":25,"ariaHidden":28},[26,27],"docs-page-hero","docs-page-hero--manilla","true",[30,32],{"type":21,"value":31},"\n  ",{"type":15,"tag":33,"props":34,"children":38},"img",{"src":35,"alt":8,"width":36,"height":37},"\u002Fimages\u002Fdocs-illustrations\u002Fauth-security.svg",128,72,[],{"type":15,"tag":40,"props":41,"children":42},"p",{},[43],{"type":21,"value":44},"Authentication is the front door for CredVault. It protects the dashboard, API, CIE CLI, Pragma auth bridge, billing, and admin workflows.",{"type":15,"tag":46,"props":47,"children":49},"h2",{"id":48},"user-facing-flow",[50],{"type":21,"value":51},"User-Facing Flow",{"type":15,"tag":40,"props":53,"children":54},{},[55],{"type":21,"value":56},"Users normally see authentication in these places:",{"type":15,"tag":58,"props":59,"children":60},"table",{},[61,85],{"type":15,"tag":62,"props":63,"children":64},"thead",{},[65],{"type":15,"tag":66,"props":67,"children":68},"tr",{},[69,75,80],{"type":15,"tag":70,"props":71,"children":72},"th",{},[73],{"type":21,"value":74},"User action",{"type":15,"tag":70,"props":76,"children":77},{},[78],{"type":21,"value":79},"Page or command",{"type":15,"tag":70,"props":81,"children":82},{},[83],{"type":21,"value":84},"Backend route",{"type":15,"tag":86,"props":87,"children":88},"tbody",{},[89,125,158,180,201,223,245,267,297],{"type":15,"tag":66,"props":90,"children":91},{},[92,98,116],{"type":15,"tag":93,"props":94,"children":95},"td",{},[96],{"type":21,"value":97},"Create an account",{"type":15,"tag":93,"props":99,"children":100},{},[101,108,110],{"type":15,"tag":102,"props":103,"children":105},"code",{"className":104},[],[106],{"type":21,"value":107},"\u002Fsignup",{"type":21,"value":109}," or ",{"type":15,"tag":102,"props":111,"children":113},{"className":112},[],[114],{"type":21,"value":115},"cie signup",{"type":15,"tag":93,"props":117,"children":118},{},[119],{"type":15,"tag":102,"props":120,"children":122},{"className":121},[],[123],{"type":21,"value":124},"POST \u002Fapi\u002Fauth\u002Fsignup",{"type":15,"tag":66,"props":126,"children":127},{},[128,133,149],{"type":15,"tag":93,"props":129,"children":130},{},[131],{"type":21,"value":132},"Sign in",{"type":15,"tag":93,"props":134,"children":135},{},[136,142,143],{"type":15,"tag":102,"props":137,"children":139},{"className":138},[],[140],{"type":21,"value":141},"\u002Fsignin",{"type":21,"value":109},{"type":15,"tag":102,"props":144,"children":146},{"className":145},[],[147],{"type":21,"value":148},"cie login",{"type":15,"tag":93,"props":150,"children":151},{},[152],{"type":15,"tag":102,"props":153,"children":155},{"className":154},[],[156],{"type":21,"value":157},"POST \u002Fapi\u002Fauth\u002Fsignin",{"type":15,"tag":66,"props":159,"children":160},{},[161,166,171],{"type":15,"tag":93,"props":162,"children":163},{},[164],{"type":21,"value":165},"Continue with Google",{"type":15,"tag":93,"props":167,"children":168},{},[169],{"type":21,"value":170},"Sign-in page",{"type":15,"tag":93,"props":172,"children":173},{},[174],{"type":15,"tag":102,"props":175,"children":177},{"className":176},[],[178],{"type":21,"value":179},"GET \u002Fapi\u002Fauth\u002Fgoogle",{"type":15,"tag":66,"props":181,"children":182},{},[183,188,192],{"type":15,"tag":93,"props":184,"children":185},{},[186],{"type":21,"value":187},"Continue with GitHub",{"type":15,"tag":93,"props":189,"children":190},{},[191],{"type":21,"value":170},{"type":15,"tag":93,"props":193,"children":194},{},[195],{"type":15,"tag":102,"props":196,"children":198},{"className":197},[],[199],{"type":21,"value":200},"GET \u002Fapi\u002Fauth\u002Fgithub",{"type":15,"tag":66,"props":202,"children":203},{},[204,209,214],{"type":15,"tag":93,"props":205,"children":206},{},[207],{"type":21,"value":208},"Read current profile",{"type":15,"tag":93,"props":210,"children":211},{},[212],{"type":21,"value":213},"Dashboard load",{"type":15,"tag":93,"props":215,"children":216},{},[217],{"type":15,"tag":102,"props":218,"children":220},{"className":219},[],[221],{"type":21,"value":222},"GET \u002Fapi\u002Fauth\u002Fprofile",{"type":15,"tag":66,"props":224,"children":225},{},[226,231,236],{"type":15,"tag":93,"props":227,"children":228},{},[229],{"type":21,"value":230},"Validate session",{"type":15,"tag":93,"props":232,"children":233},{},[234],{"type":21,"value":235},"Dashboard\u002FCLI",{"type":15,"tag":93,"props":237,"children":238},{},[239],{"type":15,"tag":102,"props":240,"children":242},{"className":241},[],[243],{"type":21,"value":244},"GET \u002Fapi\u002Fauth\u002Fme",{"type":15,"tag":66,"props":246,"children":247},{},[248,253,258],{"type":15,"tag":93,"props":249,"children":250},{},[251],{"type":21,"value":252},"Sign out",{"type":15,"tag":93,"props":254,"children":255},{},[256],{"type":21,"value":257},"Account menu",{"type":15,"tag":93,"props":259,"children":260},{},[261],{"type":15,"tag":102,"props":262,"children":264},{"className":263},[],[265],{"type":21,"value":266},"POST \u002Fapi\u002Fauth\u002Flogout",{"type":15,"tag":66,"props":268,"children":269},{},[270,275,280],{"type":15,"tag":93,"props":271,"children":272},{},[273],{"type":21,"value":274},"Reset password",{"type":15,"tag":93,"props":276,"children":277},{},[278],{"type":21,"value":279},"Forgot password page",{"type":15,"tag":93,"props":281,"children":282},{},[283,289,291],{"type":15,"tag":102,"props":284,"children":286},{"className":285},[],[287],{"type":21,"value":288},"POST \u002Fapi\u002Fauth\u002Fforgot-password",{"type":21,"value":290},", ",{"type":15,"tag":102,"props":292,"children":294},{"className":293},[],[295],{"type":21,"value":296},"POST \u002Fapi\u002Fauth\u002Freset-password",{"type":15,"tag":66,"props":298,"children":299},{},[300,305,310],{"type":15,"tag":93,"props":301,"children":302},{},[303],{"type":21,"value":304},"Select plan",{"type":15,"tag":93,"props":306,"children":307},{},[308],{"type":21,"value":309},"Plan choice page",{"type":15,"tag":93,"props":311,"children":312},{},[313],{"type":15,"tag":102,"props":314,"children":316},{"className":315},[],[317],{"type":21,"value":318},"POST \u002Fapi\u002Fauth\u002Fplan-choice",{"type":15,"tag":46,"props":320,"children":322},{"id":321},"how-it-works",[323],{"type":21,"value":324},"How It Works",{"type":15,"tag":326,"props":327,"children":328},"ol",{},[329,335,340,345,350,355],{"type":15,"tag":330,"props":331,"children":332},"li",{},[333],{"type":21,"value":334},"The user submits credentials or starts OAuth.",{"type":15,"tag":330,"props":336,"children":337},{},[338],{"type":21,"value":339},"The backend validates the user and tenant.",{"type":15,"tag":330,"props":341,"children":342},{},[343],{"type":21,"value":344},"A session token is returned to the frontend or CLI.",{"type":15,"tag":330,"props":346,"children":347},{},[348],{"type":21,"value":349},"The token is sent as a Bearer token on protected API calls.",{"type":15,"tag":330,"props":351,"children":352},{},[353],{"type":21,"value":354},"Middleware checks the token before protected routes continue.",{"type":15,"tag":330,"props":356,"children":357},{},[358],{"type":21,"value":359},"Activity logging records sensitive actions like signup, signin, logout, plan selection, and password changes.",{"type":15,"tag":40,"props":361,"children":362},{},[363],{"type":21,"value":364},"Most protected backend routes use authentication middleware before accessing user data.",{"type":15,"tag":46,"props":366,"children":368},{"id":367},"session-token-example",[369],{"type":21,"value":370},"Session Token Example",{"type":15,"tag":40,"props":372,"children":373},{},[374],{"type":21,"value":375},"After signing in, API requests use this format:",{"type":15,"tag":377,"props":378,"children":382},"pre",{"className":379,"code":380,"language":381,"meta":8,"style":8},"language-bash shiki shiki-themes github-dark","curl https:\u002F\u002Fcredvault.net\u002Fapi\u002Fauth\u002Fme \\\n  -H \"Authorization: Bearer \u003Cyour-session-token>\"\n","bash",[383],{"type":15,"tag":102,"props":384,"children":385},{"__ignoreMap":8},[386,409],{"type":15,"tag":387,"props":388,"children":390},"span",{"class":389,"line":10},"line",[391,397,403],{"type":15,"tag":387,"props":392,"children":394},{"style":393},"--shiki-default:#B392F0",[395],{"type":21,"value":396},"curl",{"type":15,"tag":387,"props":398,"children":400},{"style":399},"--shiki-default:#9ECBFF",[401],{"type":21,"value":402}," https:\u002F\u002Fcredvault.net\u002Fapi\u002Fauth\u002Fme",{"type":15,"tag":387,"props":404,"children":406},{"style":405},"--shiki-default:#79B8FF",[407],{"type":21,"value":408}," \\\n",{"type":15,"tag":387,"props":410,"children":412},{"class":389,"line":411},2,[413,418],{"type":15,"tag":387,"props":414,"children":415},{"style":405},[416],{"type":21,"value":417},"  -H",{"type":15,"tag":387,"props":419,"children":420},{"style":399},[421],{"type":21,"value":422}," \"Authorization: Bearer \u003Cyour-session-token>\"\n",{"type":15,"tag":40,"props":424,"children":425},{},[426,428,434,436,442],{"type":21,"value":427},"You can test this from the browser by opening ",{"type":15,"tag":102,"props":429,"children":431},{"className":430},[],[432],{"type":21,"value":433},"\u002Fapi-docs",{"type":21,"value":435},", pressing ",{"type":15,"tag":437,"props":438,"children":439},"strong",{},[440],{"type":21,"value":441},"Authorize",{"type":21,"value":443},", and pasting the Bearer token.",{"type":15,"tag":46,"props":445,"children":447},{"id":446},"api-key-vs-session-token",[448],{"type":21,"value":449},"API Key vs Session Token",{"type":15,"tag":40,"props":451,"children":452},{},[453],{"type":21,"value":454},"Use a session token when acting as a signed-in user:",{"type":15,"tag":377,"props":456,"children":459},{"className":457,"code":458,"language":21,"meta":8,"style":8},"language-text shiki shiki-themes github-dark","Dashboard pages\nCIE login session\nProfile and billing pages\nTeam and account settings\n",[460],{"type":15,"tag":102,"props":461,"children":462},{"__ignoreMap":8},[463,471,479,488],{"type":15,"tag":387,"props":464,"children":465},{"class":389,"line":10},[466],{"type":15,"tag":387,"props":467,"children":468},{},[469],{"type":21,"value":470},"Dashboard pages\n",{"type":15,"tag":387,"props":472,"children":473},{"class":389,"line":411},[474],{"type":15,"tag":387,"props":475,"children":476},{},[477],{"type":21,"value":478},"CIE login session\n",{"type":15,"tag":387,"props":480,"children":482},{"class":389,"line":481},3,[483],{"type":15,"tag":387,"props":484,"children":485},{},[486],{"type":21,"value":487},"Profile and billing pages\n",{"type":15,"tag":387,"props":489,"children":491},{"class":389,"line":490},4,[492],{"type":15,"tag":387,"props":493,"children":494},{},[495],{"type":21,"value":496},"Team and account settings\n",{"type":15,"tag":40,"props":498,"children":499},{},[500],{"type":21,"value":501},"Use an API key when a backend service or external application needs controlled access:",{"type":15,"tag":377,"props":503,"children":505},{"className":457,"code":504,"language":21,"meta":8,"style":8},"Server-to-server data reads\u002Fwrites\nAutomation jobs\nWebhook consumers\nInternal integrations\n",[506],{"type":15,"tag":102,"props":507,"children":508},{"__ignoreMap":8},[509,517,525,533],{"type":15,"tag":387,"props":510,"children":511},{"class":389,"line":10},[512],{"type":15,"tag":387,"props":513,"children":514},{},[515],{"type":21,"value":516},"Server-to-server data reads\u002Fwrites\n",{"type":15,"tag":387,"props":518,"children":519},{"class":389,"line":411},[520],{"type":15,"tag":387,"props":521,"children":522},{},[523],{"type":21,"value":524},"Automation jobs\n",{"type":15,"tag":387,"props":526,"children":527},{"class":389,"line":481},[528],{"type":15,"tag":387,"props":529,"children":530},{},[531],{"type":21,"value":532},"Webhook consumers\n",{"type":15,"tag":387,"props":534,"children":535},{"class":389,"line":490},[536],{"type":15,"tag":387,"props":537,"children":538},{},[539],{"type":21,"value":540},"Internal integrations\n",{"type":15,"tag":46,"props":542,"children":544},{"id":543},"security-controls-in-code",[545],{"type":21,"value":546},"Security Controls In Code",{"type":15,"tag":40,"props":548,"children":549},{},[550],{"type":21,"value":551},"CredVault currently has these controls around authentication:",{"type":15,"tag":553,"props":554,"children":555},"ul",{},[556,561,566,571,582,587,592,597,602],{"type":15,"tag":330,"props":557,"children":558},{},[559],{"type":21,"value":560},"Rate limits for signin, signup, password reset, and general API traffic",{"type":15,"tag":330,"props":562,"children":563},{},[564],{"type":21,"value":565},"Password hashing and credential validation",{"type":15,"tag":330,"props":567,"children":568},{},[569],{"type":21,"value":570},"OAuth routes for Google and GitHub",{"type":15,"tag":330,"props":572,"children":573},{},[574,576],{"type":21,"value":575},"WebAuthn\u002Fpasskey routes under ",{"type":15,"tag":102,"props":577,"children":579},{"className":578},[],[580],{"type":21,"value":581},"\u002Fapi\u002Fwebauthn",{"type":15,"tag":330,"props":583,"children":584},{},[585],{"type":21,"value":586},"Token validation middleware on protected routes",{"type":15,"tag":330,"props":588,"children":589},{},[590],{"type":21,"value":591},"IP allowlist enforcement on sensitive profile and API-key paths",{"type":15,"tag":330,"props":593,"children":594},{},[595],{"type":21,"value":596},"Activity logs for important authentication events",{"type":15,"tag":330,"props":598,"children":599},{},[600],{"type":21,"value":601},"Logout and logout-all routes",{"type":15,"tag":330,"props":603,"children":604},{},[605],{"type":21,"value":606},"Suspicious activity detection middleware",{"type":15,"tag":46,"props":608,"children":610},{"id":609},"webauthn-and-passkeys",[611],{"type":21,"value":612},"WebAuthn And Passkeys",{"type":15,"tag":40,"props":614,"children":615},{},[616],{"type":21,"value":617},"Passkeys are exposed through the WebAuthn backend route group:",{"type":15,"tag":377,"props":619,"children":621},{"className":457,"code":620,"language":21,"meta":8,"style":8},"\u002Fapi\u002Fwebauthn\n",[622],{"type":15,"tag":102,"props":623,"children":624},{"__ignoreMap":8},[625],{"type":15,"tag":387,"props":626,"children":627},{"class":389,"line":10},[628],{"type":15,"tag":387,"props":629,"children":630},{},[631],{"type":21,"value":620},{"type":15,"tag":40,"props":633,"children":634},{},[635],{"type":21,"value":636},"Use passkeys for stronger login security where supported. Passkeys are better than SMS-based MFA because they resist phishing and do not depend on mobile carrier security.",{"type":15,"tag":46,"props":638,"children":640},{"id":639},"test-it",[641],{"type":21,"value":642},"Test It",{"type":15,"tag":40,"props":644,"children":645},{},[646],{"type":21,"value":647},"Use these checks during QA:",{"type":15,"tag":377,"props":649,"children":651},{"className":379,"code":650,"language":381,"meta":8,"style":8},"# Sign in from the CLI\ncie login\n\n# Confirm the stored session\ncie whoami\n\n# Test the API from the CLI environment\ncie doctor\n",[652],{"type":15,"tag":102,"props":653,"children":654},{"__ignoreMap":8},[655,664,677,686,694,707,715,724],{"type":15,"tag":387,"props":656,"children":657},{"class":389,"line":10},[658],{"type":15,"tag":387,"props":659,"children":661},{"style":660},"--shiki-default:#6A737D",[662],{"type":21,"value":663},"# Sign in from the CLI\n",{"type":15,"tag":387,"props":665,"children":666},{"class":389,"line":411},[667,672],{"type":15,"tag":387,"props":668,"children":669},{"style":393},[670],{"type":21,"value":671},"cie",{"type":15,"tag":387,"props":673,"children":674},{"style":399},[675],{"type":21,"value":676}," login\n",{"type":15,"tag":387,"props":678,"children":679},{"class":389,"line":481},[680],{"type":15,"tag":387,"props":681,"children":683},{"emptyLinePlaceholder":682},true,[684],{"type":21,"value":685},"\n",{"type":15,"tag":387,"props":687,"children":688},{"class":389,"line":490},[689],{"type":15,"tag":387,"props":690,"children":691},{"style":660},[692],{"type":21,"value":693},"# Confirm the stored session\n",{"type":15,"tag":387,"props":695,"children":697},{"class":389,"line":696},5,[698,702],{"type":15,"tag":387,"props":699,"children":700},{"style":393},[701],{"type":21,"value":671},{"type":15,"tag":387,"props":703,"children":704},{"style":399},[705],{"type":21,"value":706}," whoami\n",{"type":15,"tag":387,"props":708,"children":710},{"class":389,"line":709},6,[711],{"type":15,"tag":387,"props":712,"children":713},{"emptyLinePlaceholder":682},[714],{"type":21,"value":685},{"type":15,"tag":387,"props":716,"children":718},{"class":389,"line":717},7,[719],{"type":15,"tag":387,"props":720,"children":721},{"style":660},[722],{"type":21,"value":723},"# Test the API from the CLI environment\n",{"type":15,"tag":387,"props":725,"children":727},{"class":389,"line":726},8,[728,732],{"type":15,"tag":387,"props":729,"children":730},{"style":393},[731],{"type":21,"value":671},{"type":15,"tag":387,"props":733,"children":734},{"style":399},[735],{"type":21,"value":736}," doctor\n",{"type":15,"tag":40,"props":738,"children":739},{},[740],{"type":21,"value":741},"Browser checks:",{"type":15,"tag":377,"props":743,"children":745},{"className":457,"code":744,"language":21,"meta":8,"style":8},"1. Open \u002Fsignin\n2. Sign in with email\u002Fpassword\n3. Open \u002Fapi-keys\n4. Confirm the page loads without redirecting back to signin\n5. Open \u002Flogs and confirm signin activity is present\n",[746],{"type":15,"tag":102,"props":747,"children":748},{"__ignoreMap":8},[749,757,765,773,781],{"type":15,"tag":387,"props":750,"children":751},{"class":389,"line":10},[752],{"type":15,"tag":387,"props":753,"children":754},{},[755],{"type":21,"value":756},"1. Open \u002Fsignin\n",{"type":15,"tag":387,"props":758,"children":759},{"class":389,"line":411},[760],{"type":15,"tag":387,"props":761,"children":762},{},[763],{"type":21,"value":764},"2. Sign in with email\u002Fpassword\n",{"type":15,"tag":387,"props":766,"children":767},{"class":389,"line":481},[768],{"type":15,"tag":387,"props":769,"children":770},{},[771],{"type":21,"value":772},"3. Open \u002Fapi-keys\n",{"type":15,"tag":387,"props":774,"children":775},{"class":389,"line":490},[776],{"type":15,"tag":387,"props":777,"children":778},{},[779],{"type":21,"value":780},"4. Confirm the page loads without redirecting back to signin\n",{"type":15,"tag":387,"props":782,"children":783},{"class":389,"line":696},[784],{"type":15,"tag":387,"props":785,"children":786},{},[787],{"type":21,"value":788},"5. Open \u002Flogs and confirm signin activity is present\n",{"type":15,"tag":40,"props":790,"children":791},{},[792],{"type":21,"value":793},"API checks:",{"type":15,"tag":377,"props":795,"children":797},{"className":379,"code":796,"language":381,"meta":8,"style":8},"curl https:\u002F\u002Fcredvault.net\u002Fapi\u002Fauth\u002Fprofile \\\n  -H \"Authorization: Bearer \u003Cyour-session-token>\"\n",[798],{"type":15,"tag":102,"props":799,"children":800},{"__ignoreMap":8},[801,817],{"type":15,"tag":387,"props":802,"children":803},{"class":389,"line":10},[804,808,813],{"type":15,"tag":387,"props":805,"children":806},{"style":393},[807],{"type":21,"value":396},{"type":15,"tag":387,"props":809,"children":810},{"style":399},[811],{"type":21,"value":812}," https:\u002F\u002Fcredvault.net\u002Fapi\u002Fauth\u002Fprofile",{"type":15,"tag":387,"props":814,"children":815},{"style":405},[816],{"type":21,"value":408},{"type":15,"tag":387,"props":818,"children":819},{"class":389,"line":411},[820,824],{"type":15,"tag":387,"props":821,"children":822},{"style":405},[823],{"type":21,"value":417},{"type":15,"tag":387,"props":825,"children":826},{"style":399},[827],{"type":21,"value":422},{"type":15,"tag":46,"props":829,"children":831},{"id":830},"common-failures",[832],{"type":21,"value":833},"Common Failures",{"type":15,"tag":58,"props":835,"children":836},{},[837,858],{"type":15,"tag":62,"props":838,"children":839},{},[840],{"type":15,"tag":66,"props":841,"children":842},{},[843,848,853],{"type":15,"tag":70,"props":844,"children":845},{},[846],{"type":21,"value":847},"Symptom",{"type":15,"tag":70,"props":849,"children":850},{},[851],{"type":21,"value":852},"Likely cause",{"type":15,"tag":70,"props":854,"children":855},{},[856],{"type":21,"value":857},"Fix",{"type":15,"tag":86,"props":859,"children":860},{},[861,879,902,920,938],{"type":15,"tag":66,"props":862,"children":863},{},[864,869,874],{"type":15,"tag":93,"props":865,"children":866},{},[867],{"type":21,"value":868},"User is sent back to signin",{"type":15,"tag":93,"props":870,"children":871},{},[872],{"type":21,"value":873},"Missing or expired token",{"type":15,"tag":93,"props":875,"children":876},{},[877],{"type":21,"value":878},"Sign in again",{"type":15,"tag":66,"props":880,"children":881},{},[882,887,892],{"type":15,"tag":93,"props":883,"children":884},{},[885],{"type":21,"value":886},"CLI says session expired",{"type":15,"tag":93,"props":888,"children":889},{},[890],{"type":21,"value":891},"Stored token is invalid",{"type":15,"tag":93,"props":893,"children":894},{},[895,897],{"type":21,"value":896},"Run ",{"type":15,"tag":102,"props":898,"children":900},{"className":899},[],[901],{"type":21,"value":148},{"type":15,"tag":66,"props":903,"children":904},{},[905,910,915],{"type":15,"tag":93,"props":906,"children":907},{},[908],{"type":21,"value":909},"OAuth callback fails",{"type":15,"tag":93,"props":911,"children":912},{},[913],{"type":21,"value":914},"OAuth app callback URL mismatch",{"type":15,"tag":93,"props":916,"children":917},{},[918],{"type":21,"value":919},"Check provider settings",{"type":15,"tag":66,"props":921,"children":922},{},[923,928,933],{"type":15,"tag":93,"props":924,"children":925},{},[926],{"type":21,"value":927},"Profile request fails",{"type":15,"tag":93,"props":929,"children":930},{},[931],{"type":21,"value":932},"Token missing or IP allowlist blocked request",{"type":15,"tag":93,"props":934,"children":935},{},[936],{"type":21,"value":937},"Check token and security policy",{"type":15,"tag":66,"props":939,"children":940},{},[941,946,951],{"type":15,"tag":93,"props":942,"children":943},{},[944],{"type":21,"value":945},"Plan page cannot continue",{"type":15,"tag":93,"props":947,"children":948},{},[949],{"type":21,"value":950},"Plan-choice user context missing",{"type":15,"tag":93,"props":952,"children":953},{},[954],{"type":21,"value":955},"Sign in through CredVault first",{"type":15,"tag":46,"props":957,"children":959},{"id":958},"best-practices",[960],{"type":21,"value":961},"Best Practices",{"type":15,"tag":553,"props":963,"children":964},{},[965,970,975,980,985,998],{"type":15,"tag":330,"props":966,"children":967},{},[968],{"type":21,"value":969},"Do not store API keys in frontend code.",{"type":15,"tag":330,"props":971,"children":972},{},[973],{"type":21,"value":974},"Use session tokens for user actions and API keys for server automation.",{"type":15,"tag":330,"props":976,"children":977},{},[978],{"type":21,"value":979},"Rotate API keys used by production services.",{"type":15,"tag":330,"props":981,"children":982},{},[983],{"type":21,"value":984},"Use passkeys or MFA for admin users.",{"type":15,"tag":330,"props":986,"children":987},{},[988,990,996],{"type":21,"value":989},"Review ",{"type":15,"tag":102,"props":991,"children":993},{"className":992},[],[994],{"type":21,"value":995},"\u002Flogs",{"type":21,"value":997}," after authentication changes.",{"type":15,"tag":330,"props":999,"children":1000},{},[1001],{"type":21,"value":1002},"Keep OAuth callback URLs aligned with production and staging domains.",{"type":15,"tag":1004,"props":1005,"children":1006},"style",{},[1007],{"type":21,"value":1008},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":8,"searchDepth":411,"depth":411,"links":1010},[1011,1012,1013,1014,1015,1016,1017,1018,1019],{"id":48,"depth":411,"text":51},{"id":321,"depth":411,"text":324},{"id":367,"depth":411,"text":370},{"id":446,"depth":411,"text":449},{"id":543,"depth":411,"text":546},{"id":609,"depth":411,"text":612},{"id":639,"depth":411,"text":642},{"id":830,"depth":411,"text":833},{"id":958,"depth":411,"text":961},"markdown","content:docs:features:auth.md","content","docs\u002Ffeatures\u002Fauth.md","docs\u002Ffeatures\u002Fauth","md",1794695980415]