Password Authentication

Password authentication is the default auth_mode. Users provide a username and password on the login page, which Autentico validates before issuing an authorization code.

How it works

1. The user is redirected to /oauth2/authorize with the standard OAuth2 parameters
2. Autentico renders the login page
3. The user submits their credentials via POST /oauth2/login
4. Autentico validates the credentials, checks for account lockout, and either:
   • Issues an MFA challenge (if mfa_enabled is true), or
   • Issues an authorization code and redirects back to the client

Password storage

Passwords are hashed with bcrypt before storage. The plaintext password is never stored or logged.

Account lockout

After a configurable number of consecutive failed login attempts, the account is temporarily locked. See Account Lockout for configuration details.

Validation rules

Username and password validation rules are enforced at registration and can be configured via runtime settings:

Setting	Default	Description
validation_min_username_length	4	Minimum username length
validation_max_username_length	64	Maximum username length
validation_min_password_length	6	Minimum password length
validation_max_password_length	64	Maximum password length
validation_username_is_email	false	Require username to be a valid email format
validation_email_required	false	Require email field at registration

Tip

To add a second factor on top of password authentication, enable MFA. See Multi-Factor Authentication.

Signup submissions to /signup and /signup/ share the existing authentication rate limiter with login, MFA and token requests. Limits are per resolved client IP and per server process: both token buckets must permit the request (defaults 5 requests/second with burst 10, and 20 requests/minute with burst 20). Rejected requests receive HTTP 429 and Retry-After: 1. The signup form is served through the already-limited /authorize endpoint; /signup accepts POST submissions. Existing AUTENTICO_RATE_LIMIT_* settings apply; disabling the limiter also disables signup throttling.