Skip to main content
Archie Auth is the built-in authentication system — email/password sign-in, user management, password reset, and email verification, all configured per-environment. Enable it with one click, and your users can sign up, verify their email, log in, and recover passwords without you wiring any of it up. It’s the recommended starting point for new projects: you get bcrypt password hashing, JWT tokens with optional encryption, brute-force protection, customizable email templates, and a full admin user-management panel out of the box.

​
What Archie Auth handles

​
When to use Archie Auth vs. a third-party provider

You can also run Archie Auth alongside other providers — for example, Archie Auth for email/password and Google for social sign-in, with both writing to the same user record.

​
Per-environment isolation

Archie Auth configuration, signing keys, and user records are all per-environment. Each environment maintains:
  • Its own auth configuration (password policy, token TTLs, email templates).
  • Its own RSA signing and encryption keys.
  • Its own user list.
Tokens issued in one environment are not valid in another. Auth configuration is not copied when branching environments — you enable it independently in each.

​
Where to go next

Getting started

Enable Archie Auth, configure it, and run the full sign-up / sign-in flow.

User management

Block, force-logout, and otherwise manage registered users from the dashboard.

Security

Password hashing, rate limiting, key rotation, and JWE encryption.

Email templates

Customize verification and recovery emails plus sender branding.

GraphQL API

GraphQL mutations and queries for every auth operation.

REST API

HTTP endpoints — /auth/signup, /auth/login, /auth/refresh-token, and the JWKS endpoint.

​
FAQ

Yes. Each environment is isolated — enable it once per environment that needs auth. Auth configuration is intentionally not copied when branching, so a leaked dev secret can’t compromise production.
Yes — sign users up via the standard signup endpoint with their existing emails. Passwords have to be reset (you can’t import bcrypt hashes from a different cost factor) — the standard recovery flow handles that. For machine-readable user data, use the GraphQL API.
All active refresh tokens are revoked. When you re-enable, you can choose whether to drop the _auth_credentials table (wiping users) or keep it (so existing users can sign in again).
Yes — minimum length, required character classes, max failed attempts, and lock duration are all configurable per environment. See Security.
Not in the built-in flow today. For MFA, run a third-party provider like Auth0 alongside or in place of Archie Auth.