Bot protection on sign in, sign up, and password reset
Keeps bots off your sign in, sign up, and password reset screens. Turn it on in Auth, Settings and we handle the rest. Most real visitors pass without seeing a puzzle.
Details
It starts off. Turn it on and your live app asks visitors to pass a quick check before those three screens go through, which stops the spam signups and password guessing that bots run at scale. Turn it back off any time and the screens go straight through again. Either way your other protections keep running, and the change is live right away without rebuilding your app.
Where to enable it
Toggle this feature in your project editor. No code required.
Inside the editor, head to Auth → Settings.
Open in my projectRelated features
Password policies & MFA
Minimum password strength, rotation rules, and multi-factor authentication (TOTP). Configured in Auth → Credentials. MFA enrollment UI is built into the platform, no code needed.
Signup rules & access control
Control who can sign up: open registration, invite-only, email domain allowlists, required email verification. Configured in Auth → Settings, applied automatically across all login methods.
Email & password login, password recovery, magic links
Sign in with email and password, or with a magic link, comes ready to use. Forgot password is built into the same sign-in form: your users enter their email, get a code, and set a new password without leaving the page.