Authentication that ships with your product_
Give users a secure sign-in experience without building auth infrastructure. Appwrite Auth supports the methods your users expect, team collaboration signals, and the controls your team needs.
Welcome back
Sign in to your account
Verification code
482 913
Check your inbox
- OAuth providers
- 40+
- Sign-in methods
- 7
- Memberships & roles
- Multi-Tenancy
- Two-factor auth
- MFA
- Team collaboration
- Presences
OAuth 2 and social login
Enable 30+ social providers from the Console Social providers tab. Users sign up in one click with GitHub, Google, Apple, and the identity providers your audience already uses.
Social providers
Enable OAuth 2 sign-in for external accounts.
Passwordless login
Turn on Magic URL, Email OTP, and Phone SMS from Auth settings. Ship secure sign-in without storing or resetting passwords.
Sign in
Choose a method
Magic URL
Email link sign-in
Email OTP
6-digit code
Phone SMS
Text verification
6-digit code
Multi-tenancy with teams and roles
Model each customer or workspace as a team with memberships, invites, and roles. Scope databases, storage, and other resources to the right tenant from the Console Users and Teams tabs, without building custom RBAC.
Acme Engineering
3 members · Owner access
Walter O'Brien
walter@acme.io
OwnerPaige Dineen
paige@acme.io
DeveloperHappy Quinn
happy@acme.io
Memberdocuments.reports
SSR authentication
Verify sessions from Next.js, Nuxt, SvelteKit, and other server-rendered apps. Issue session cookies from your backend with dedicated guides and tutorials.
import { createSessionClient } from '@appwrite.io/ssr'
const client = createSessionClient(request)
const user = await client.account.get()Session verified
Security policies you control
Fine-tune Auth from the Console Policies and Settings tabs. Set session length and limits, password strength and history, email signup rules, membership privacy, and which auth methods are enabled for your project.
Session length
30 days
Sessions limit
10 active sessions
Session alerts
Enabled
Invalidate sessions
Enabled
Password policies
Email policies
Multi-factor authentication
Add TOTP authenticator apps and recovery codes for sensitive accounts. Require MFA when users update credentials or access protected actions.
Authenticator app
Acme
paige@acme.io
482 190
GitHub
paige
913 024
Enter verification code
MFA enabled
Presence for team collaboration
Show who is online, on the same page, or typing in team chat. Presences sync status and metadata over Realtime so you can add collaboration cues to shared docs, dashboards, and support tools without building sockets.
Shared doc
Q4 launch plan
Happy Quinn is typing in team chat
Tools built for developers and agents_
API-first by design. Use the Console, Realtime, SDKs, CLI, Terraform, MCP, and agent skills on the same project.
Developer and agent experience
A typical integration in TypeScript.
import { Client, Account } from 'appwrite';
const client = new Client() .setEndpoint('https://<REGION>.cloud.appwrite.io/v1') .setProject('<PROJECT_ID>');
const account = new Account(client);
const session = await account.createEmailPasswordSession({ email: 'paige@example.com', password: 'password',});
console.log(session.userId);Everything is an API
REST, GraphQL, and SDKs for every service. Automate and integrate without console-only workflows.
Console
Manage every service in your project from a unified Console. Optimized keyboard access and a Command Center keep you moving fast.
Realtime
Subscribe to live events and react to changes as they happen.
account
users.*.create
MCP
Connect AI agents to your Appwrite project, APIs, and docs through one remote MCP server.
appwrite
https://mcp.appwrite.ioTerraform
Manage Appwrite infrastructure as code with the official provider.
terraform plan
terraform applyAgent skills
Give AI agents SDK-accurate knowledge of Appwrite services and APIs.
npx skills add appwrite/skillsSDKs
Client and server SDKs for the platforms your team already uses. 15 official SDKs available across client and server runtimes.
CLI
Deploy resources, manage projects, and generate typed SDKs from your terminal.
appwrite login
appwrite deployFAQ_
Yes. Appwrite Auth is API-first, so you keep full control of the UI in your app and call the Account SDK for sign-up, login, sessions, and MFA. Quick starts cover React, Next.js, Vue, SvelteKit, Flutter, and other platforms. For server-rendered apps, verify sessions on your backend and issue HTTP-only cookies using the SSR guides.
Yes. Appwrite supports OAuth 2.0 with 30+ providers, including GitHub, Google, Apple, Discord, and Microsoft. Enable providers in the Console under Auth > Social providers, add your OAuth credentials and redirect URI, then start the flow from the Account SDK. Each OAuth sign-in creates an identity linked to the user account, so one person can connect multiple providers without duplicate accounts.
Enable Magic URL, Email OTP, and Phone SMS from Auth settings in the Console. Magic URL sends a one-click sign-in link to the user's email. Email OTP delivers a time-limited code they enter in your app. Phone SMS verifies users through text messages without a password. You can offer passwordless methods alongside email and password, or disable password login entirely for a password-free experience.
Create a team for each customer, organization, or workspace in your app. Invite members by email, assign roles, and scope databases, storage buckets, functions, and other resources with team-based permissions. Teams give you tenant isolation without building custom RBAC, and membership privacy settings let you control whether member lists are visible to other users.
Enable MFA in Auth settings, then let users enroll an authenticator app (TOTP) and download recovery codes. MFA adds a second step after the primary sign-in method. Require it for sensitive actions such as updating credentials or accessing protected resources. Users who lose their device can sign in with a recovery code instead of the TOTP.
Yes. Turn on Passkey in Auth settings and pick your app's domain. Users register a passkey after signing up, then sign in with Face ID, Touch ID, a fingerprint, or the device PIN, without an email or password. The same passkey works on your website and in your Android and iOS apps, and a passkey session also satisfies MFA.
Yes. Import users through the Console or the Users API with the Server SDK. For email and password accounts, create users with plain-text passwords or import existing password hashes when your provider uses a supported algorithm: Argon2, bcrypt, scrypt, scrypt-modified (Firebase), SHA, MD5, or PHPass. New passwords are stored with Argon2. Hashes imported from other algorithms are upgraded to Argon2 after the user's first successful sign-in.
Appwrite hashes passwords with Argon2, including salting and adjustable work factors. From Auth Policies and Settings, set minimum length, character requirements, password history, dictionary checks, and rules that block personal data in passwords. Email policies can block disposable, aliased, or free-provider addresses at sign-up. Session settings control duration, limits per user, and cookie behavior for web apps.
Auth is included in every Appwrite deployment. Self-hosted installations use the same Auth APIs, SDKs, OAuth providers, policies, and session behavior as Appwrite Cloud. Configure auth methods, password rules, and security policies from the Console the same way.
Start building with Auth_
Create a project and add authentication in minutes with our quick start guides.
Explore Appwrite_
Modular backend services that share the same project, permissions model, and console.