# Which sign-in methods can I offer my users?

Source: https://help.didit.me/authentication/sign-in-methods
Updated: 2026-11-12

Choose how your users sign in with Didit Authentication: passkey, email code, magic link, password, Google, Microsoft, Apple, GitHub, phone or SSO.

Open **Authentication** in the console sidebar, then **Sign-in methods**, and switch on the methods you want people to see in the sign-in box.
You can offer passkeys, email codes, magic links, email and password, Google, Microsoft, Apple, GitHub, phone codes and single sign-on.
The live preview on the right shows the page as people will see it, and **Try your sign-in page** opens the real hosted page.

![The Sign-in methods page in the Didit console, with one card per sign-in method and a live preview of the sign-in box](https://help.didit.me/screenshots/auth-sign-in-methods-light.webp)

*Sign-in methods: one card per method, and a live preview of your sign-in box.*

## Switch methods on

1. **Open Sign-in methods**

   In the console, open your application, then **Authentication** and **Sign-in methods**. The methods are grouped by kind: passwordless, password, social, phone and enterprise.

2. **Configure a method**

   Each method is a card with its status and a **Configure** button. Select **Configure**, turn the switch **Show ... in the sign-in box** on or off, fill in anything the method needs, and save. The card then reads **In your sign-in box** or **Not in your sign-in box**, or shows the method's share of your sign-ins once people use it.

3. **Check the preview, then try it**

   The preview updates after you save. Select **Try your sign-in page** to open the hosted page in a new tab. If nothing opens, allow pop-ups for the console. The preview shows saved methods only, so test sign-in in a Sandbox application.

Changing methods needs a role that can edit applications (by default Developer, Admin and Owner). Reader and Compliance Officer can see the page.

## The methods

| Method | What the person does | What you set up |
|---|---|---|
| Passkey | Signs in with the fingerprint, face or screen lock of their device. | Nothing. After sign-up the hosted page offers to add a passkey. |
| Email code | Types a six-digit code sent by email, valid for ten minutes. | Nothing. |
| Magic link | Selects a single-use link sent by email, valid for 15 minutes. It must be opened in the same browser that asked for it. | Nothing. |
| Email and password | Types their email address and password. | Password rules are in the [security article](https://help.didit.me/authentication/bot-protection-mfa-and-sessions). |
| Google, Microsoft, Apple, GitHub | Selects **Continue with** the provider. | **Configure**: your own Client ID and Client secret from the provider, and the **Provider callback URL** the console shows you. Live applications need your own credentials. Sandbox can use **Didit test credentials**. |
| Phone code | Types a code sent to their phone. | A phone verification workflow, because phone delivery follows it. Until it is set up the console says phone sign-in has not been set up for the application. |
| Single sign-on | Signs in with their company's identity provider. | Set up per customer organization, see [organizations](https://help.didit.me/authentication/users-sessions-and-organizations). Needs the Scale plan. |

## The second step

You can ask people for a second step after the first. It is an authenticator app (with recovery codes) or a passkey. SMS and email codes cannot be a second step.
Two-step login needs the Growth plan. Who must use it, and the rest of the policy, are in [bot protection, two-step login and sessions](https://help.didit.me/authentication/bot-protection-mfa-and-sessions).

## What people see on the hosted page

The hosted page shows:

- The title **Sign in to** followed by your application name, and the subtitle **Welcome back! Sign in to continue.**
- One button per social method, for example **Continue with Google**, and **Sign in with a passkey**.
- The divider **or**, then the **Email address** field and **Continue**.
- Links to the other ways in, such as **Email me a code**, **Email me a sign-in link**, **Use a phone number** and **Use single sign-on**.
- **Don't have an account?** with **Sign up**, and the "Secured by Didit" badge unless your plan removes it.

If no method is on, the preview says **Pick at least one sign-in method.**
When someone opens a magic link in a different tab, the first tab shows **Check your inbox** and the new tab offers **Continue in this tab instead**.

Titles, buttons and emails come in English, Spanish, French, German and Japanese. The page uses the language of the person's browser.
To change the colors, logo, texts and address, see [branding and emails](https://help.didit.me/authentication/sign-in-page-branding-and-emails).

## How long things last

- Email and phone codes: ten minutes, with five tries.
- Magic links: 15 minutes, used once.
- Password reset links: 30 minutes.
- Invitation links: seven days.
- After five wrong passwords the account is locked for 15 minutes with the default protection. Your bot protection settings can change this.

## Wrong password, unknown email and locked accounts look the same

A wrong password, an email address that has no account, an unverified email and a locked or blocked account all show the same generic message.
This is deliberate: your sign-in page cannot tell which case it was, and neither can an attacker, so nobody can use it to find out which email addresses have an account.
Your team sees more in **Sign-ins**, where a failed attempt shows its reason in plain words, for example **The account is locked after too many tries** or **The account is blocked**. Sign-in logs with 30 days of history need the Scale plan.

## Related

- [Branding the sign-in pages and emails](https://help.didit.me/authentication/sign-in-page-branding-and-emails)
- [Bot protection, two-step login and sessions](https://help.didit.me/authentication/bot-protection-mfa-and-sessions)
- [Sign-in methods in the Didit docs](https://docs.didit.me/authentication/sign-in-methods)