continuwuity/docs/authentication/internal.mdx

# Internal authentication

Continuwuity comes with an internal database for user authentication, which it uses by default. This allows for self-servicing of account registration, linking emails, and password resets.

## Registration

The following registration methods are available for Continuwuity:

| Method | Description                       | Additional configuration needed                                                                                                   |
| ------ | --------------------------------- | --------------------------------------------------------------------------------------------------------------------------------- |
| 1      | Admin-issued tokens (recommended) | None. Use the [`!admin token issue`](../reference/admin/token#admin-token-issue) command                                          |
| 2      | Static registration token         | `registration_token` or `registration_token_file`                                                                                 |
| 3      | Token + email                     | Method 1 or 2 + `require_email_for_token_registration = true` in `[global.smtp]`. See [Email configuration](#email-configuration) |
| 4      | Email-only registration           | `require_email_for_registration = true` in `[global.smtp]` section. See [Email configuration](#email-configuration)               |
| 5      | reCAPTCHA-only registration       | `recaptcha_site_key` and `recaptcha_private_site_key`                                                                             |
| 6      | Email + reCAPTCHA registration    | Methods 4 + 5                                                                                                                     |

Admin-issued tokens are the recommended registration method. These tokens are well suited for private or invite-only servers, and they can be scoped with an expiry duration or given a usage limit. See the [`!admin token`](../reference/admin/token) commands for more details.

Other registration methods are meant for **untrusted, public registration**. Care must be taken when allowing these modes of operation.

If you wish to disable registration entirely, set `allow_registration = false` in your config file.

## Email configuration

Continuwuity can be configured to send emails via an SMTP relay of your choice. These are used for verifying user email addresses and sending password reset links to them.

A user is associated with only **one** email address at a time.

All email options are in the `[global.smtp]` block of the [configuration file](../reference/config.mdx), and are toggled on when the block is uncommented. For example:

```toml
[global.smtp]
# Example URI for the user john@example.com on the `mail.example.net` mail server
connection_uri = "smtps://john%40example.com:password@mail.example.net:465"
sender = "John's Continuwuity server <john@example.com>"
```

A user's email address can also be modified by the [`!admin users change-email`](../reference/admin/users#admin-users-change-email) command. To view current user-email associations, use the `!admin users get-email` and `!admin users get-user-by-email` command.

Use [`!admin debug send-test-email`](../reference/admin/debug#admin-debug-send-test-email) to test that your email setup is working.

## Password resets

Password resets in Continuwuity can be made via:

- Self-service password resets. This requires a user's email to have been set up and verified.
- Using the [`!admin users reset-password`](../reference/admin/users#admin-users-reset-password) command.