docs/authentication.mdx

# Authentication

This chapter describes various ways to authenticate to Continuwuity.

## Authentication flows

Continuwuity implements the following authentication flows:

- **OAuth login** (also known as **next-gen auth**): clients redirect the user to Continuwuity's own login and registration page to complete the authentication process.
- **Legacy login** (also known as the **UIAA** framework): clients provide their own UI to log in to or register with the server directly.

Different sets of clients support different flows, but most clients are moving towards next-gen auth. One can set which login mode(s) are allowed via the `compatibility_mode` variable of the `[global.oauth]` config file section.

:::important Configure your client well-known for OAuth logins

To ensure OAuth logins work, Continuwuity must know the base URL its Client-Server API is being served on:

```toml
[global.well_known]
client = "https://matrix.example.com"
```

Refer to the [delegation](./guides/delegation) documentation for more details.

:::

## Authentication sources

Continuwuity can read user authentication data from the following sources:

- **Internal database** - this is the default setup for Continuwuity. It allows for registration, email, and password reset self-service. See the [**internal authentication documentation**](./authentication/internal).

- **Delegated authentication** - in this mode, the server connects to an OpenID Connect identity provider for user authentication. This method allows for integrating with single sign-on services, but enabling it will disable legacy logins. See the [**delegated authentication documentation**](./authentication/oidc).

Only one authentication source can be used at a time.
docs: Initialize authentication chapter 2026-08-21 15:28:10 +00:00			`# Authentication`
chore(docs): Add some todos 2026-09-10 05:46:29 +00:00
docs(auth): Writeup on auth sources and flows 2026-09-12 05:48:14 +00:00			`This chapter describes various ways to authenticate to Continuwuity.`
chore(docs): Add some todos 2026-09-10 05:46:29 +00:00
docs(auth): Writeup on auth sources and flows 2026-09-12 05:48:14 +00:00			`## Authentication flows`

			`Continuwuity implements the following authentication flows:`

docs(auth): Address concerns from feedback part 1 2026-09-12 16:04:32 +00:00			`- OAuth login (also known as next-gen auth): clients redirect the user to Continuwuity's own login and registration page to complete the authentication process.`
			`- Legacy login (also known as the UIAA framework): clients provide their own UI to log in to or register with the server directly.`
docs(auth): Writeup on auth sources and flows 2026-09-12 05:48:14 +00:00
			Different sets of clients support different flows, but most clients are moving towards next-gen auth. One can set which login mode(s) are allowed via the `compatibility_mode` variable of the `[global.oauth]` config file section.

docs(auth): Simplify auth sources section & add client well-known notice 2026-09-12 08:00:41 +00:00			`:::important Configure your client well-known for OAuth logins`

docs(auth): Address concerns from feedback part 1 2026-09-12 16:04:32 +00:00			`To ensure OAuth logins work, Continuwuity must know the base URL its Client-Server API is being served on:`
docs(auth): Simplify auth sources section & add client well-known notice 2026-09-12 08:00:41 +00:00
			```toml
			`[global.well_known]`
			`client = "https://matrix.example.com"`
			```

			`Refer to the [delegation](./guides/delegation) documentation for more details.`

			`:::`
chore: Add few todos 2026-09-12 06:00:25 +00:00
docs(auth): Writeup on auth sources and flows 2026-09-12 05:48:14 +00:00			`## Authentication sources`

			`Continuwuity can read user authentication data from the following sources:`

docs(auth): Simplify auth sources section & add client well-known notice 2026-09-12 08:00:41 +00:00			`- Internal database - this is the default setup for Continuwuity. It allows for registration, email, and password reset self-service. See the [internal authentication documentation](./authentication/internal).`
docs(auth): Reword sources section a bit 2026-09-14 04:07:32 +00:00
			`- Delegated authentication - in this mode, the server connects to an OpenID Connect identity provider for user authentication. This method allows for integrating with single sign-on services, but enabling it will disable legacy logins. See the [delegated authentication documentation](./authentication/oidc).`

			`Only one authentication source can be used at a time.`