Sign in

An existing user proves who they are. Every entry mode shares these screens; only the exit differs.

Map

Screens

Route	Screen	Purpose
/	Index	Email first. Decides between sign in and sign up.
/signin, /oauth/signin	Signin	Enter the password. Also hosts the passkey and Google/Apple buttons.
/force_auth, /oauth/force_auth	Signin	Same screen with the email locked, for a client that already knows the account.
/signin_passkey_fallback	SigninPasskeyFallback	Passkey failed or unsupported; use the password.
/signin_passwordless_code, /oauth/signin_passwordless_code	SigninPasswordlessCode	Emailed code for an account with no password.
/signin_token_code	SigninTokenCode	Emailed code to confirm an unverified session.
/signin_totp_code	SigninTotpCode	Authenticator app code.
/signin_recovery_choice	SigninRecoveryChoice	Choose a backup code or the recovery phone.
/signin_recovery_code	SigninRecoveryCode	Backup authentication code.
/signin_recovery_phone	SigninRecoveryPhone	SMS code to the recovery phone.
/signin_unblock	SigninUnblock	Unblock code emailed after rate limiting.
/signin_bounced	SigninBounced	The account email bounced.
/complete_signin	CompleteSignin	Landing for the confirm sign-in email link; finishes the session and continues to /pair.
/signin_confirmed, /signin_verified	SigninConfirmed	Signed-in confirmation kept for old links. The current flow continues to /pair instead.
/report_signin	ReportSignin	Landing for the "this wasn't me" email link.
/signin_reported	SigninReported	Report confirmation.
/post_verify/password/force_password_change	force_password_change (legacy)	Mandatory password change after a security event.
/signin_permissions	permissions (legacy)	Consent screen for untrusted relying parties. Not reachable from React.
/confirm_signin, /confirm	confirm (legacy)	Link-based "check your email" screens, replaced by code entry.

Notes

• Exit depends on the entry mode: web goes to /settings, a relying party gets a redirect with a code, Sync sends credentials to the browser and continues to /pair. See Entry modes.
• A relying party that requires two-step authentication sends the user through /inline_totp_setup first. A passwordless account entering Sync goes through /post_verify/set_password.