Changelog
auth.codai.ro: one sign-in with passkeys, TOTP, magic links and device flow
A single identity provider now signs you in to every codai surface. Passkeys are first-class, and CLIs pair through a device code.
- Auth
- Platform
All codai surfaces — the hub, the web app, docs, checkout and the admin console — now sign you in through a single identity provider at auth.codai.ro. Sign in once, and you are signed in everywhere.
What is new
- Passkeys first. Register a passkey on your laptop or phone and sign in with Face ID, Touch ID or Windows Hello. Passwords remain available.
- Two-factor with TOTP. Any authenticator app works; you get ten recovery codes when you enable it.
- Magic links. Sign in from an e-mail link when you do not have your password to hand. E-mail verification and password reset use the same path.
- Device flow for CLIs. Terminal tools show a short code; approve it in the browser and the CLI is paired — no copying tokens around.
- Step-up for sensitive actions. Billing changes ask for a fresh second factor even inside an active session.
- Logout everywhere. Signing out of one app ends the shared session and notifies the others.
For developers
The provider speaks standard OpenID Connect and OAuth 2.1 with PKCE. Confidential clients authenticate with signed JWTs rather than shared secrets, and signing keys rotate without downtime. The sign-in and consent screens are rebuilt on the new design system and available in Romanian and English.