Codes and links
auth.signin.start takes email_code, email_link or sms_code and returns a challengeId; auth.signin.verify takes that and the secret the person received.
A code is six digits, lives ten minutes and allows five attempts. A link lives fifteen minutes. email_link also needs a redirectTo on an allowed redirect origin, because the link has to land somewhere.
All three are on by default. Nothing about the answer reveals whether the address already has an account.
Passwords, which are off until you ask
password is the one method that starts switched off. Turn it on with auth.settings.set, then auth.password.set gives a user one and auth.password.signin uses it.
The rules are the environment’s: at least twelve characters by default, and a breach check that asks a k-anonymity range service and fails closed when it cannot reach it. auth.password.remove takes a password off an account without touching the account.
Passkeys
auth.passkey.register.start and auth.passkey.register.verify add one; auth.passkey.signin.start and auth.passkey.signin.verify use it. auth.passkey.list and auth.passkey.remove are the user’s own management.
A passkey binds to an origin, so this method is unavailable until the environment has one: either a relying party id, or at least one allowed redirect origin to derive it from. Change the relying party id later and every passkey already registered under the old one stops working.
Google, Microsoft and GitHub
auth.oauth.start returns where to send the person; auth.oauth.complete turns what comes back into a session.
All three work through Lath’s own registered app, which means the consent screen says Lath. auth.oauth.app.set replaces that with your own client id and secret so it says your name instead; auth.oauth.app.list shows which is in use, and auth.oauth.app.remove goes back to the shared one.
Enabled is not the same as offered
auth.settings.get reports three things per method: whether it is enabled, whether it is available, and whether it is therefore offered — plus the reason when it is not. A method can be switched on and still not work: sms_code needs a carrier registration that is active and a phone number to send from, and a social provider needs an app registered for it.
Leaving one enabled while it is unavailable is fine. It starts being offered the moment what it needs is in place, and until then the hosted sign-in page does not show it.
Calling a method that is switched off is refused with method_disabled. Starting too many sign-ins is refused with rate_limited: five per address and thirty per IP address in ten minutes, and thirty completions per IP address in the same window.