Configuration

Authentication settings are managed separately for preview and production. Pass or Buy never copies preview secrets, sessions, or test-user passwords into production.

Current policy

• Email and password is the preview testing baseline.
• Google OAuth remains optional until its client credentials and callback allowlist are configured.
• Magic-link and phone-number sign-in are disabled.
• Organization invitations and self-service organization creation are separate controls.
• Routes under the dashboard and settings areas require an authenticated session and active organization.

Production requires verified email ownership. Password reset and invitation delivery require the approved email service and verified sending domain before public launch.