Auth Node

Verifies user credentials (password or passkey), issues an access token, and optionally a session token. The primary authentication gate in any login flow.

Authentication Node

Node Card

Auth

true

false

Error edges

4007 · 4008 · 4009

4010 · 4011 · 4013 · 4076

Category: Authentication Nodes

Type: auth

Typical position: After a Web Page node collecting Identity + Password, before MFA Configured State or a Success Final node.

---

Properties

Property	Type	Default	Description
Access Token	checkbox	true (read-only)	Always issues an access token on successful authentication. Cannot be disabled.
Session Token	checkbox	false	When enabled, issues a short-lived session-scoped feature token in addition to the access token. Required for MFA flows: MFA Configured State reads this token to look up the user's registered methods.
Error Handling	custommultiselect	All errors set to automatic	Lets you override the default message shown to users for each error code. Setting a custom message activates that error code as a named output edge on the canvas.

Outputs & Errors

The Auth node emits a true or false output plus one edge per error code configured in the Error Handling property.

Output / Code	Condition	Default message
true	Credentials valid, access token issued	NA
false	Authentication failed (catch-all for unhandled errors)	NA
4007	Identity not found in the directory	User does not exist
4008	Account is blocked by admin or policy	Your account is blocked
4009	Account is locked (e.g. too many failed attempts)	Your account has been locked
4010	Email address has not been verified	Email is not verified
4011	Phone number has not been verified	Phone number is not verified
4013	Password has passed its expiry date	Password is expired
4076	Credentials submitted but are incorrect	Invalid user ID and/or password

tip

Error edges only appear on the canvas when you explicitly select them in the Error Handling property. An unselected error code falls through to the false output. Select only the errors you plan to handle with a dedicated path.

---

Usage in Flows

The Auth node is the anchor of every login flow. A minimal email login places it after the Web Page node:

For flows that include MFA, the Auth node's true output connects to MFA Configured State. In that case, Session Token must be enabled: MFA Configured State uses it to look up the user's registered MFA methods.

---

When to Use / When Not To

Use Auth for credential verification in login flows

Auth is the right node any time you need to verify an email/password pair and issue an access token in a single step. Place it after the Web Page node that collects credentials. Wire true to the next step (MFA or Success Final) and false back to the Web Page to surface an inline error.

Auth without Session Token when MFA follows

MFA Configured State reads the session token to look up the user's registered MFA methods. If Session Token is disabled on Auth, MFA Configured State has nothing to read and will fail silently.

Auth (Session Token: off) → MFA Configured State

Auth (Session Token: on) → MFA Configured State

Leaving named error edges unconnected in production

Unconnected named edges fall through to false (loop back to the login form). A locked-out user, an expired password, or an unverified email all look like "wrong credentials" with no recovery path. Wire each edge to an appropriate node.

accountlocked→ Route to Unlock Account node or a locked-account info page

passwordexpired→ Route to an Update Password screen

emailunverified→ Route to Send Email (verification template)

phoneunverified→ Route to Send SMS (verification template)

---

Common Next Nodes

Auth (true)→MFA Configured StateMFA flows: Session Token must be enabled

Auth (true)→Success Finalsimple login without MFA

Auth (false)→Web Pageretry / inline error