Skip to main content
Authentication is configured per environment from the Portal Admin Dashboard. Your Development and Production environments have separate settings, separate credentials, and separate Auth Environment IDs, so you can enable a method in Development without affecting live users.

​
Open the configuration page

Step 1: Log in to the Portal Admin Dashboard and select the environment you want to configure. Step 2: Click Configure in the left sidebar, under Authentication.
Authentication Configure page showing the Enabled toggle and the General, TOTP, Email Magic Link, Google OAuth, and Apple OAuth sections
Step 3: Turn on Enabled. Until you do, the rest of the page stays hidden and every Authentication API request for this environment is rejected with 401.
Enable toggle in Configure page

​
Auth Environment ID

The Auth Environment ID is the value your app sends in the x-portal-auth-environment-id header on every Authentication API request. Portal generates it for you and it does not change. Copy it from this section.
Auth Environment ID section with the generated identifier and a copy button
Each environment has its own Auth Environment ID. You will also need it when registering redirect URIs with Google and Apple.

​
General

Auto-create wallet records whether your app should create a wallet for a user as soon as they finish signing in. This is a boolean that is internally used in Portal SDKs to signal if a wallet should be created at the time an End User is created. Redirect URLs is the allow list of pages in your app that a sign-in is allowed to return a user to. Add every callback page you use, for example https://example.com/callback.
Redirect URLs section listing two allowed callback URLs with add and remove controls
Redirect URLs are matched by exact string comparison. Wildcards and path prefixes are not supported, and https://example.com/callback does not match https://example.com/callback/ or https://example.com/callback?next=/home. Add each exact URL you intend to pass as redirectUrl.
A request whose redirectUrl is not on this list is rejected with 401. This is what stops someone who has your Auth Environment ID from redirecting your users and their sign-in tokens to a site they control.

​
Choose sign-in methods

Each method has its own section with its own toggle. Enabling a method adds it to the allowedAuthMethods array returned by GET /auth/methods.
  • Email Magic Link. No credentials to enter here, but before you can send anything you need a verified sending domain and an email template. See Email magic links.
  • Google OAuth. Requires a Client ID and Client secret from Google Cloud Console. See Google OAuth.
  • Apple OAuth. Requires a Team ID, App ID, Service ID, Key ID, and private key from your Apple Developer account. See Apple OAuth.

​
Provider credentials are write-only

Portal encrypts provider secrets and never returns them. If you need to check whether the credentials are configured or not, you can check the tag on the labels of the form. You can still replace the value if needed.
Google OAuth section with the enable toggle and write-only Client ID and Client secret fields showing configured badges

​
Require two-factor authentication

The TOTP section adds a second factor to every sign-in for this environment, whichever method the user chose.
TOTP section with the Require TOTP toggle and the TOTP issuer field
  • Require TOTP turns the second factor on.
  • TOTP issuer is the name shown next to the code in the user’s authenticator app. Use your product name.
Turning this on changes the shape of your sign-in flow, so read Two-factor authentication before enabling it in Production.

​
Verify your configuration

Call GET /auth/methods with your Auth Environment ID to confirm the environment is live and reporting the methods you expect:
A 401 here means the header does not match an environment, or Enabled is still off.

​
Next steps

Email magic links

Verify a sending domain and build your magic link email.

Google OAuth

Create a Google OAuth client and register Portal’s redirect URI.

Apple OAuth

Set up a Services ID and Sign in with Apple key.

End users

Review who has signed in and manage their two-factor enrollment.