Authentication methods

Huudis gives your users several ways to prove who they are. Every method converges on the same session and the same OIDC tokens issued to your app, so you don't have to special-case any of them in your code.

You can see which methods are available, and (for MFA) whether you've enrolled, in the portal under Authentication (/dashboard/authentication).

What's supported

Method	What it is	Notes
Email & password	The default. Email + password, with verification and rate-limited login.	Always available. See Sign in.
Social login	One-tap sign-in with Google, Apple, or Facebook.	Available per provider when its credentials are configured. See Social providers.
Magic link	Passwordless sign-in via a single-use link emailed to the user.	Optional — the user chooses it; existing verified users only. See Magic link.
Multi-factor (MFA)	A second factor after the first: an authenticator app (TOTP) or an emailed code.	Opt-in per user. See Multi-factor authentication.
OAuth2 / OIDC	Huudis itself is the identity provider — it issues tokens to your apps.	Authorization Code + PKCE, refresh, device code, and more. See OIDC overview.

How they fit together

A login is two steps: a first factor (password, social, or magic link) proves the account, and — if the user has enrolled MFA — a second factor (authenticator or email code) confirms it. Whichever first factor the user picks, the MFA gate is identical, and on success Huudis issues the same huudis_session cookie and the same OIDC tokens to your app.

Authentication methods are managed globally by Huudis; there are no per-workspace on/off toggles today. Social providers are enabled by configuring their credentials; magic link and MFA are available to every user to opt into.