Every project has a set of settings that can change how the authentication for that site works and the security measures taken.

These settings can be changed through the JustAuthenticate dashboard.

Basic project settings

The basic project settings exists of the name, description and redirect url.

The name and description of the project is purely cosmetic changes that shows the users which site they are logging into.

Redirect url

The redirect url is the url a user is redirected to after succesfully authenticating.

This url will also be displayed to the user upon authenticating to show which site they will be giving access to.

There are 2 ways of getting the code, it will either be as a url parameter or a url query, this can be chosen by either enabling query or not in the project dashboard

Parameter: https://project.com/api/<code> Query: https://project.com/api?code=<code>

Platforms

Which platforms are available to use for a project can be changed.

So if a site only wants to allow logins from Google and Discord this can be done by disabling every other platform.

By default every possible platform is allowed and can be used by the users.

The currently supported platforms are:

• Discord
• Google
• Github

Ip whitelist

The ip whitelist is a list of all the ips that are allowed to get the user data. This will prevent others from getting user data as you in case the project secret was accidentally leaked.

If the list is left empty anyone with the project secret and a user login code can retrieve the user data, this can be done for a development project, but it is recommended to add the ip to the whitelist for production usage.

User whitelist/blacklist

To limit who can login to the project it is possible to enable both a user whitelist and blacklist.

If the whitelist is enabled only users who's email is on the whitelist is allowed to login to the site. This can be useful in case only specific users are allowed to use the site, for example during development or beta testing.

If the blacklist is enabled any user who's email matches an entry on the list will be blocked from logging in to the site

The entry allows regex to allow specific checks for the email, for example any user with an email from a specific domain can be allowed or blocked from a single entry that looks like this: *@domain.com.