Users

Users are the people who sign in to your app. They are different from Forte account members: account members operate projects in the Forte console, while Users authenticate to the product you are building and are scoped to one Project.

Identity model

A User can have verified email or phone contact methods, password credentials, an OAuth identity, enrolled MFA methods, sessions, custom attributes, and an administrative state. Contact verification and session state are explicit so your app can distinguish an unverified registration, pending MFA challenge, active session, and administrative suspension.

Responsibility boundary

Forte operates credential storage, verification delivery, supported authentication protocols, session issuance, configured MFA challenges, and user audit records. You choose which methods to enable. You also set password and session policies, authorization rules inside your app, notification content, recovery policy, and how your app uses personal data.

Start with the flow, then the method

Read Authentication for sign-in flows and edge cases. Use the method-specific pages below when implementing passwords, MFA, reauthentication, sessions, or administration.

Step up before sensitive actions

Before a sensitive action, you can ask a signed-in user to verify an authentication factor again. Forte records the time on the current session. Your app decides how recent it must be. See Reauthentication.