Low Code Authentication Patterns

Orientation

When you add authentication on a low-code platform, the visual builder hides the protocol details but still demands exact configuration—get one redirect URI wrong and the login loop never resolves; get the session flag wrong and user data leaks. This page is the reference you open when the builder’s “Add Auth” button isn’t enough. Each section below is organized by the actual authentication problem you’re solving, not by feature menus, and includes the exact configuration keys, CLI flags, code snippets, and error text that make or break the pattern.

Embedding Email/Password Authentication

Configuration key: auth.login.provider = "email_password" CLI flag (if your platform exposes one): lowcode auth:init --provider email_password --require-email-confirmation

Code snippet (typical form‑validation hook in the platform’s generated backend):

// In a low-code “before create” action for the Users table
async function beforeCreate(ctx) {
  if (!ctx.req.body.password.match(/^(?=.*[a-z])(?=.*[A-Z])(?=.*\d).{8,}$/)) {
    throw new Error("Password does not meet complexity requirements");
  }
  // Platform‑managed password hash; no plaintext storage
  return ctx;
}

Exact error text you’ll see in the platform log when the hook rejects the record: ValidationError: Password does not meet complexity requirements

Sharp edge: The “password complexity” rule is enforced only on the client‑side form if you don’t include the beforeCreate hook above. If a citizen developer disables the hook to “speed up” onboarding, the platform will accept weak passwords, and the underlying database will store them hashed with the platform’s default algorithm—which may not meet your compliance baseline. Another silent failure: the require-email-confirmation flag defaults to false. If left on, every new user receives a magic‑link email, but if the email service endpoint is misconfigured (e.g., auth.email.sender = "[email protected]"), the link bounces and the account never activates, leaving the user stuck at the login screen with no obvious error besides a never‑spinning spinner.

Connecting Social/OAuth Providers

Configuration keys: auth.sso.providers[0].client_id = "YOUR_GOOGLE_CLIENT_ID" auth.sso.providers[0].client_secret = "YOUR_GOOGLE_CLIENT_SECRET" auth.sso.providers[0].redirect_uris = ["https://app.example.com/auth/callback"]

CLI flag: lowcode auth:sso:add --provider google --client-id "$GOOGLE_ID" --client-secret "$GOOGLE_SECRET" --redirect-uri "https://app.example.com/auth/callback"

Code snippet (callback handler that the platform generates; you only need to add the verification logic):

// In a low-code “on request” action for the /auth/callback route
export async function onRequest(context) {
  const code = context.req.query.code;
  if (!code) {
    return { status: 400, body: "Missing authorization code" };
  }
  // Platform‑provided exchange; do not replace with your own token request
  const tokens = await context.auth.exchangeCodeForTokens(code, {
    redirectUri: "https://app.example.com/auth/callback",
  });
  // Store the ID token in a secure, httpOnly cookie
  context.res.cookies.set("session", tokens.id_token, {
    httpOnly: true,
    secure: true,
    maxAge: 60 * 60 * 24 * 14, // 14 days
    sameSite: "lax",
  });
  return { status: 302, headers: { Location: "/" } };
}

Exact error text you’ll see in the platform console when the redirect URI doesn’t exactly match a registered value: OAuthError: redirect_uri mismatch: https://app.example.com/auth/callback is not registered for this client

Sharp edge: The most common silent failure is a trailing‑slash discrepancy. If you register https://app.example.com/auth/callback but the platform appends /?code=xyz, the OAuth provider returns a redirect_uri mismatch error and the callback never fires. Another confused option: auth.sso.providers[0].scope. Setting scope="profile email" when the provider only supports scope="openid profile email" causes the consent screen to skip the email field, and the user’s email address ends up null in your user record. You only learn this after a production ticket reports “users can’t log in with Google Workspace accounts” — the fix is adding email to the scope list or removing it entirely if the platform auto‑extracts it.

Managing Session Tokens & JWTs

Configuration key: auth.session.cookie.secure = true auth.session.cookie.httpOnly = true auth.session.cookie.sameSite = "strict" jwt.expiry = "14d"

Code snippet (middleware that validates the JWT on every request; the platform runs this automatically if you enable the flag, but you can inspect the payload):

// In a low-code “before load” action on your app’s root page
export async function onRequest(context) {
  const token = context.req.headers["authorization"]?.replace("Bearer ", "");
  if (!token) {
    return { status: 401, body: "Missing or malformed JWT" };
  }
  try {
    const payload = await context.auth.verifyJwt(token, {
      audience: "https://app.example.com",
      issuer: "https://auth.example.com",
    });
    // Attach user identity to the request for downstream actions
    context.locals.user = {
      id: payload.sub,
      email: payload.email,
      roles: payload.role ?? [],
    };
  } catch (err) {
    // Platform‑generated error; do not log raw token
    return { status: 401, body: "Invalid or expired session" };
  }
  return context.next();
}

Exact error text you’ll see in the browser console (via the platform’s dev tools) when the token signature is invalid: JWTError: invalid signature

Sharp edge: A silently failing pattern is setting auth.session.cookie.secure = true in a development environment served over HTTP. The platform will accept the setting but the browser will refuse the cookie, causing the session to appear “logged out” after every page reload. You only notice this when a citizen developer asks why the app works on localhost but not on the staging URL. Another production‑breaking confusion: jwt.expiry vs auth.session.maxAge. If you set both, the session cookie may be deleted after the shorter interval, but the JWT payload still carries the longer expiry, causing the middleware to reject a valid‑looking token that the browser no longer holds. The fix is to keep a single source of truth—either derive jwt.expiry from auth.session.maxAge or vice‑versa, never both.

Enforcing MFA / TOTP

Configuration key: auth.mfa.totp.enabled = true

This page was rewritten on 10 October 2026. It replaced a templated version whose text was largely shared with other pages in this section and was not specific to its own title. The new text was drafted with a locally run language model, checked by a separate reviewer model for specificity and for invented figures, and measured against its sibling pages for duplication before publication. If anything here is wrong, tell us at [email protected] and we will correct it.