Authentication Configuration

The Authentication Configuration page allows you to control how users authenticate and access your InstiKit application.

These settings affect login security, password recovery, user registration, OTP verification, two-factor authentication (2FA), and OAuth login providers.

Important

Authentication settings apply globally to all users. Review these options carefully before enabling them, especially in a production environment.

Login Security

These settings help protect user accounts from unauthorized access and brute-force attacks.

Login Throttle Max Attempt

Specify the maximum number of failed login attempts allowed before an account is temporarily locked.

A lower value provides better security but may inconvenience users who frequently enter incorrect passwords.

Recommended Value: 5

Login Throttle Lock Timeout

Specify how long a user must wait before attempting to log in again after exceeding the maximum number of failed login attempts.

The value is specified in minutes.

Recommended Value: 2

Password Management

Reset Password

Enable this option to allow users to reset forgotten passwords.

If disabled, users cannot request password reset links.

This feature is recommended for most installations.

Reset Password Token Lifetime

Specify how long a password reset link remains valid.

The value is specified in minutes.

Recommended Value: 30

Two-Factor Authentication (2FA)

Two Factor Security

Enable this option to allow users to secure their accounts using Time-based One-Time Passwords (TOTP).

Once enabled, users will see a Two-Factor Authentication option in their profile settings, where they can configure an authenticator application such as:

• Google Authenticator
• Microsoft Authenticator
• Authy
• 1Password
• Any other TOTP-compatible application

After setup, users must enter both their password and the generated verification code during login.

Recommended

Enable Two-Factor Authentication for administrators and users with access to sensitive information.

User Registration

Registration

Enable this option to allow visitors to create new accounts through the registration page.

Recommended for Schools

In most educational institutions, this option should remain disabled.

Student, parent, teacher, and employee accounts are normally created by school administrators through the ERP rather than allowing public self-registration.

Enable this feature only if your organization specifically requires online self-registration.

Account Approval

When enabled, newly registered users must be approved by an administrator before they can access the application.

This setting is useful if public registration is enabled.

Show Terms on Registration

Display the Terms and Conditions checkbox during the registration process.

Users must accept the terms before creating an account.

Email Verification

Email Verification

Require newly registered users to verify their email address before accessing the application.

This helps prevent fake registrations and ensures that users own the email address they provide.

OTP Authentication

InstiKit supports One-Time Password (OTP) based authentication.

Depending on your configuration, users can receive OTPs through email or SMS.

OTP Login

Enable OTP-based login.

When enabled, users can authenticate using a one-time verification code instead of their password.

SMS OTP Login

Allow OTP codes to be sent through SMS.

This feature requires SMS gateway configuration.

Email OTP Login

Allow OTP codes to be sent through email.

This feature requires email configuration.

OTP Lifetime

Specify how long generated OTP codes remain valid.

The value is specified in minutes.

Recommended Value: 10

OAuth Login

InstiKit supports authentication using third-party identity providers.

OAuth login allows users to sign in using their existing accounts without creating separate passwords.

To use any OAuth provider, you must first create an application with the respective provider and configure the required credentials.

Enable Google OAuth

Allow users to sign in using their Google account.

After enabling this option, configure:

• Google Client ID
• Google Client Secret
• Google Callback URL

Google Client ID

Enter the Client ID provided by Google Cloud Console.

Google Client Secret

Enter the Client Secret generated for your Google OAuth application.

Keep this value confidential.

Google Callback URL

Configure the callback URL in both InstiKit and your Google Cloud project.

The callback URL must match exactly.

Enable Facebook OAuth

Allow users to authenticate using their Facebook account.

This requires Facebook Developer configuration.

Enable Twitter OAuth

Allow users to authenticate using their Twitter (X) account.

This requires Twitter Developer credentials.

Enable GitHub OAuth

Allow users to sign in using their GitHub account.

This feature is commonly used by developers and technical organizations.

Enable Microsoft OAuth

Allow users to authenticate using their Microsoft account.

This is particularly useful for organizations using Microsoft 365 or Azure Active Directory.

Recommendations

For most schools and educational institutions, the following configuration is recommended:

Saving Changes

After modifying any authentication settings, click Save to apply the changes.

Some changes, such as enabling or disabling authentication methods, may require users to sign out and log in again before the new settings take effect.