See every sign-in attempt and active session under Authentication, then sign a person out, block or unlock them, reset MFA, and manage organizations and agents.
Open Authentication → Sign-ins to see every sign-in attempt and every active session, and press Revoke to end a session. To act on one person, open their record under Authentication → Users and use the Authentication group: send a sign-in link, revoke all sessions, block or unblock sign-in, unlock, reset MFA or send a password reset.
This article covers the people who sign in to your own app with Didit Authentication. For turning Authentication on, see add sign-in to your app.
#Users: one list for everyone
Users in the Authentication sidebar is the same people list you use for verifications. It is not a separate list. A person who signs in to your app and is verified with Didit is one record.
A person's record has an Authentication group with the sections Sign-in and Agent access. The actions are:
| Action | What it does | Who can do it |
|---|---|---|
| Send a sign-in link | Emails the person a link that signs them in. It works for 15 minutes. | Owner or Admin |
| Revoke all sessions | Ends every session now, on every device, agent sessions included. The person signs in again with any of their methods. | Members who can change Authentication |
| Block sign-in | The person can no longer sign in. Their sessions and agent access end now. | Members who can change Authentication |
| Unblock | Lets a blocked person sign in again. | Members who can change Authentication |
| Unlock | Lets a person back in after an account was locked by too many failed tries. | Members who can change Authentication |
| Reset MFA | Removes every second factor, passkeys included. The person gets an email saying who reset it and when, and every session and agent grant ends. They sign in with their password or a sign-in link and set up a new factor. | Owner or Admin |
| Send password reset | Emails the person a password reset. | Members who can change Authentication |
On Send a sign-in link and Reset MFA, a member who is not an Owner or Admin sees "Only an Owner or Admin can do this." The other actions need a role that can change Authentication: Developer, Admin or Owner by default. User bans are part of the Growth plan and up. See pricing and active users.
#Sign-ins: attempts and sessions
Authentication → Sign-ins has two tabs.
#Sign-in attempts
Each attempt has a state: Success, Failed, Challenged or Blocked. Challenged means the person was asked for an extra proof. Blocked means the attempt was refused, for example by bot protection or by your Blocklist.
- Filter by State, Method or Risk, or search by email, IP address or sign-in ID.
- Columns: State, Person, Method, Device, Location, Risk and Time.
- Press Show older attempts to look further back.
A failed attempt shows the reason in plain words, for example "Wrong email or password", "Wrong or expired code", "The account is locked after too many tries" or "The account is blocked".
#Active sessions
The Active sessions tab lists Person, Device, Location, Started, Last active and Ends. Press Revoke on a row to end that session at once. The person signs in again with any of their methods. To end every session of one person, use Revoke all sessions on their record.
#What you see without Scale
Keeping 30 days of sign-in logs, with every attempt, device and result searchable, is part of the Scale plan and up. Without it, your sign-ins show only in the totals on the Authentication overview.
#Organizations
Organizations is for business apps: your customers' own organizations inside your app, with members, roles, verified domains and single sign-on. Turn it on in Authentication → Organizations in a Live application. A person can belong to several organizations. Company logins (SAML and OIDC) for an organization need the Scale plan or higher.
Create an organization with New organization. Renaming or deleting an organization is not available yet, and the settings People can create organizations and Personal accounts read Not available yet.
#Agent access
Agent access lets people approve their own AI agents with scoped access that they, or your team, can revoke. In Authentication → Agent access you can:
- Switch Personal AI agents on or off. When it is off, new approvals are disabled and existing sessions continue until they end or are revoked.
- Choose the scopes you offer: Read account information and Change account settings.
- Set how people approve. Only people approve agent requests needs the approving person's own passkey, and only an Owner or Admin can change it.
- See each active session and press Revoke. Other agents the person approved keep working.
#Related
- How to require MFA, set session length and stop bots
- Add sign-in to your app
- Authentication overview in the docs
- Sign-in methods, organizations and agent access in the docs
Still stuck? Talk to a human.
Include your organization ID and the session ID you are asking about.