# Authentication Flow

> Login, signup, password reset, SSO, MFA, and authentication UX patterns.

- Skill: `dragoon0x/authentication-flow` (Agent Skill)
- Install (CLI): `npx skillmds@latest add dragoon0x/authentication-flow`
- Raw SKILL.md: https://api.skillmd.com/api/skills/dragoon0x/authentication-flow/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: dragoon0x (https://skillmd.com/u/dragoon0x)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/dragoon0x/authentication-flow

---


# Authentication Flows

## Sign Up
- **Minimum fields:** Email and password (or just email for magic link)
- **Social sign-in** options above the form (Google, GitHub, Apple)
- **Password requirements** shown proactively, not after failed attempt
- **Email verification** via link, not code (less friction)

## Log In
- Email + password as default
- "Remember me" checkbox
- "Forgot password?" link visible near password field
- Show/hide password toggle
- Rate limit failed attempts (show "try again in X seconds")

## Password Reset
1. Enter email → 2. Check email → 3. Set new password → 4. Confirmed
- Don't confirm whether the email exists (security)
- Reset links expire (1 hour typical)
- Invalidate old passwords on reset

## Multi-Factor Authentication
- SMS codes are the minimum (but weakest)
- Authenticator apps are better (TOTP)
- Passkeys/WebAuthn are best (no codes needed)
- Recovery codes: show once, make user save them
- Don't force MFA setup during onboarding (ask after first valuable action)

## Single Sign-On
- Prominent SSO buttons with correct brand colors and logos
- "Continue with Google" not "Sign in with Google" (works for both login and signup)
- Handle account linking (same email, different auth method)

## Session Management
- Show active sessions in settings
- Allow remote logout
- Auto-logout after inactivity (configurable for sensitive apps)
- Extend session silently on activity (no popup interruptions)