> For the complete documentation index, see [llms.txt](https://docs.codemash.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.codemash.io/cloud/membership/settings/authentication.md).

# Authentication

**Where:** Membership → Settings → Authentication · `/projects/<project>/membership/settings#authentication`

{% hint style="info" %}
Screenshot TODO — capture comes from testing-plan area **16-membership**.
{% endhint %}

Two sections: **Auth preferences** (logout redirects) and **Passkey** (passwordless sign-in with WebAuthn). The old `#auth` and `#passkey` links land here.

## Auth preferences

| Field                       | What it does                                                                   |
| --------------------------- | ------------------------------------------------------------------------------ |
| Default logout URL          | Where to redirect users after logout when no environment-specific URL applies. |
| Logout URL (\<environment>) | One row per project environment that has its own redirect.                     |
| + Add logout environment    | Pick a project environment and the URL to redirect its users to after logout.  |

## Passkey

An **Enabled** switch turns passkey sign-in on for the project, then:

| Field                                                        | What it does                                        |
| ------------------------------------------------------------ | --------------------------------------------------- |
| Accepted authenticators                                      | Which authenticator types are allowed for passkeys. |
| Max passkeys per user                                        | Upper limit of registered passkeys.                 |
| Allow magic-link recovery                                    | Let users recover access via an emailed link.       |
| Email code lifetime (minutes)                                | How long emailed sign-in codes stay valid.          |
| Generate recovery codes at sign-up / Recovery codes per user | One-time codes for account recovery.                |
| Refresh token lifetime (days)                                | How long sessions can be renewed.                   |
| Relying Party ID (advanced)                                  | The WebAuthn domain binding for passkeys.           |

Passkey users create their credentials on their own devices, so they sign up through your app — the dashboard's [Add New User](/cloud/membership/users/new.md) screen only links here.

## API reference

Endpoints: [Membership → Passkeys](/api-reference/membership/passkeys-recovery.md).