Netlify Identity

Use @netlify/identity (npm). For new projects it replaces the legacy netlify-identity-widget and gotrue-js. Do not reach for those.

npm install @netlify/identity

Framework examples (Next.js/Astro/Remix/SvelteKit) and the full API reference are in the @netlify/identity README on npm.

Identity does not run under netlify dev. Test all auth flows on a deploy. Deploy Previews work. Local dev will not complete signup/login/OAuth.

Identity config is dashboard-only. There is no public API. Never curl api.netlify.com to flip or read Identity settings, never read tokens from local Netlify config, and never probe undocumented endpoints. Enable and configure Identity at https://app.netlify.com/projects/{site_name}/identity.

Never build a from-scratch OAuth flow alongside Identity. No provider app registration in code, no client_id/secret in source, and no custom callback token exchange. Use oauthLogin() + handleAuthCallback(). Raw OAuth beside Identity is the most common source of rework.

Client auth (browser)

import { signup, login, logout, getUser, oauthLogin, handleAuthCallback } from '@netlify/identity'

// Register — confirmation email sent by default (unless autoconfirm is on)
const user = await signup('jane@example.com', 'securepassword', { full_name: 'Jane Doe' })

// Log in / out
await login('jane@example.com', 'securepassword')
await logout()

// Current user or null
const current = await getUser()
if (current) console.log(`Logged in as ${current.email}`)

// External provider — redirects the browser; provider is one of
// 'google' | 'github' | 'gitlab' | 'bitbucket'
oauthLogin('github')

handleAuthCallback() is mandatory on your landing page. Without it, OAuth redirects, email-confirmation links, password-recovery links, and invite links never complete. Call it on page load.

Invites are NOT logged in by handleAuthCallback(). For an invite it returns type === 'invite' with the token in result.token and result.user === null. The account does not exist yet. You must collect a password and call acceptInvite(result.token, password). If you skip this step, invited users never get an account.

import { handleAuthCallback, acceptInvite } from '@netlify/identity'

const result = await handleAuthCallback() // falsy if no token in URL hash
if (result?.type === 'invite' && result.token) {
  // Invited user has no account yet. Ask them to choose a password first.
  const password = (document.getElementById('password') as HTMLInputElement).value
  const user = await acceptInvite(result.token, password)
  console.log('Account created:', user.email)
} else if (result) {
  // OAuth, email confirmation, recovery, or email change
  console.log(result.type, result.user?.email)
}

For recovery tokens you can call recoverPassword() directly instead. Refresh a session with refreshSession().

Don't hard-code which providers exist. Call getSettings() at startup and render the signup form and OAuth buttons from what it returns.

Server-side auth (Netlify Functions & Edge Functions)

Server-side getUser()/login()/admin.* require modern v2 functions (export default). The v1 export { handler } form is not supported.

getUser() works in both runtimes. admin.* runs ONLY in Netlify Functions. It does not run in the browser or in Edge Functions.

// netlify/functions/me.ts — verify user
import { getUser } from '@netlify/identity'
import type { Context } from '@netlify/functions'

export default async (req: Request, context: Context) => {
  const user = await getUser()
  if (!user) return new Response('Unauthorized', { status: 401 })
  return Response.json({ id: user.id, email: user.email })
}

The Edge Function form is identical but imports Context from @netlify/edge-functions.

Role checks

// netlify/functions/admin-users.ts
import { getUser, admin } from '@netlify/identity'
import type { Context } from '@netlify/functions'

export default async (req: Request, context: Context) => {
  const user = await getUser()
  if (!user) return new Response('Unauthorized', { status: 401 })
  if (!user.roles.includes('admin')) return new Response('Forbidden', { status: 403 })
  const users = await admin.listUsers()
  return Response.json({ users })
}

CSRF: required for server-side auth endpoints

Any endpoint that runs login(), signup(), or logout() server-side must call verifyRequestOrigin(req) at the top of the handler. It throws a 403 on origin mismatch.

// netlify/functions/login.ts
import { login, verifyRequestOrigin } from '@netlify/identity'
import type { Context } from '@netlify/functions'

export default async (req: Request, context: Context) => {
  verifyRequestOrigin(req)
  const { email, password } = await req.json()
  await login(email, password)
  return new Response(null, { status: 302, headers: { Location: '/dashboard' } })
}

Identity event functions

The platform calls your handler when an Identity event occurs. Export a default object with a method per event. File: netlify/functions/identity.mts.

Typed handlers (UserSignupEvent, event.deny()) require @netlify/functions ≥ 5.2.0. Older installs must use the legacy filename convention (identity-signup.ts, etc.). See references/authorization-and-sessions.md.

Handler	Fires when
userValidate	Signup attempt, before account creation. Block bad signups here.
userSignup	Signup completes (after email confirmation if enabled). Assign roles, sync, welcome.
userLogin	User logs in. Track/last-seen/block.
userModified	Profile updated.
userDeleted	User deleted (notification only).

Event user fields are camelCase (appMetadata, userMetadata, confirmedAt).

// netlify/functions/identity.mts — deny a signup
import type { UserValidateEvent } from "@netlify/functions"

export default {
  userValidate(event: UserValidateEvent) {
    if (!event.user.email?.endsWith("@example.com")) return event.deny()
  },
}

// netlify/functions/identity.mts — assign roles at signup
import type { UserSignupEvent } from "@netlify/functions"

export default {
  userSignup(event: UserSignupEvent) {
    return { user: { ...event.user, appMetadata: { ...event.user.appMetadata, roles: ["member"] } } }
  },
}

• event.deny() rejects the action. The end user gets a 401, and no error appears in observability. The first handler to call it aborts the chain, and later subscribers are not invoked. Legacy filename functions signal denial with a non-2xx Response instead.
• Return { user: {...} } to modify the record before it is persisted. This is the canonical way to set roles at signup. Roles ride in the JWT, so a role change takes effect on the user's next login or token refresh, not immediately. See Roles & the JWT below.
• Background mode: export const config: Config = { background: true }. The action completes immediately and the handler runs asynchronously.

Roles & the JWT

• user.roles is read from app_metadata.roles and carried in the JWT (cookie nf_jwt; refresh via nf_refresh).
• user_metadata holds the user-editable profile (full_name, email). app_metadata holds app data, including roles, and is not user-editable.

Role changes are NOT immediate. They take effect on next login or token refresh. Changing roles does not invalidate the current JWT. Force a refresh with refreshSession().

Set roles for existing users via admin.updateUser() in a Netlify Function. Set them at signup via the userSignup event handler above.

Deep guides for SSR/session hydration and authorization live in references/advanced-patterns.md and references/authorization-and-sessions.md.

CDN-edge RBAC (redirect rules)

Enforced at the edge with no origin round trip. A mismatched role gets a 404 unless you add a fallback. Always pair a role-gated rule with a fallback.

_redirects:

/admin/*  /admin/:splat  200!  Role=admin
/admin/*  /login         401!
# Multiple roles chained with commas:
/private/* /private/:splat 200! Role=editor,admin

netlify.toml:

[[redirects]]
  from = "/admin/*"
  to = "/admin/:splat"
  force = true
  status = 200
  conditions = {Role = ["editor", "admin"]}

Use redirect rules for path-based gating. Use function-based user.roles checks for custom authorization logic.

Configuration (dashboard-only)

Base: https://app.netlify.com/projects/{site_name}/identity. Enable with Enable Identity. Identity requires HTTPS, so set up SSL before integrating on a custom domain.

• Registration (?tab=registration#registration-preferences): Open (default; anyone can sign up) or Invite only (all users, including external-provider logins, must be invited first).
• Confirmation / autoconfirm (?tab=emails#confirmation-template): check the box to skip email verification.
• External providers (?tab=registration#external-providers): Google/GitHub/GitLab/Bitbucket. For branded OAuth (your app name instead of "Netlify Identity"), register your app with the provider, get a client ID and secret, and enter them in the Netlify settings UI, not in code.
• Invitations (?tab=users): enter addresses to send invites. The link carries invite_token. Complete it with handleAuthCallback() + acceptInvite(token, password) as shown above.
• Password recovery: on the user page, use Send reset password email. The link carries recovery_token.

Emails (Pro plans or higher)

The default sender is no-reply@netlify.com. A custom SMTP sender and custom templates both require Pro plans or higher.

Template variables (Go syntax): {{ .Email }}, {{ .NewEmail }} (email-change only), {{ .SiteURL }}, {{ .ConfirmationURL }}, {{ .Token }}.

Custom-link hash fragments per action:

{{ .SiteURL }}/path/#invite_token={{ .Token }}
{{ .SiteURL }}/path/#confirmation_token={{ .Token }}
{{ .SiteURL }}/path/#recovery_token={{ .Token }}
{{ .SiteURL }}/path/#email_change_token={{ .Token }}

Custom template constraints:

• Inline CSS only.
• Absolute image links.
• No <html>/<head>/<body> tags.
• Ensure your build doesn't alter Go template variables.

Audit log (Pro plans or higher)

?tab=audit-log. Search with a scoped term: author:[string] or action:[string].

Action names: login, logout, user_signedup, user_deleted, user_modified, token_revoked, token_refreshed, user_recovery_requested, user_invited.

External JWT providers (Enterprise)

Available on Enterprise plans. You may use Netlify Identity OR an external JWT provider, not both at once. You cannot authenticate third-party JWTs while Netlify Identity is enabled.

• Roles path: Netlify Identity uses app_metadata.roles; an external provider uses app_metadata.authorization.roles. For a custom path, contact support.
• The JWT header must be {"alg": "HS256", "typ": "JWT"} (HS256 required). The payload exp is required and must be a future Unix Epoch time.
• Set the JWT secret at Project configuration > General > Visitor access > JWT secret. Project-level settings override team-level defaults.

On failure — stop, don't guess

If callbacks 404, /.netlify/identity/* is unreachable, or an OAuth flow never returns:

1. Surface the error.
2. Give the dashboard URL (https://app.netlify.com/projects/{site_name}/identity).
3. Name the setting to check (registration preference, external provider config, confirmation/autoconfirm).
4. Then stop. Do not invent recovery commands.

Remember: Identity does not work under netlify dev. Confirm you are testing on a deploy.

Site-gating requests ("lock this site to my company", employees-only) route to the netlify-access-control skill first. Identity is the app-level user layer only. Restricting who can view the whole project uses project visibility or Password Protection, not Identity.

<!-- gap: getSettings() signature/return shape is not documented in the intermediate. --> <!-- gap: handleAuthCallback() result.type strings other than 'invite' are not enumerated. --> <!-- system: agent-context/identity/system.md — human-owned, merged by ctx-gen; edit system.md, not this section -->

Netlify house rules (identity)

These are org conventions, not docs facts — merged into the rendered skill by ctx-gen and never generated. Owned by the skills maintainer.

1. Deep guides live in this skill: references/advanced-patterns.md (SSR/session hydration) and references/authorization-and-sessions.md.
2. Identity does not work under netlify dev — test auth flows on deploys (Deploy Previews work).
3. Identity configuration has no public API — it is dashboard-only. Never curl api.netlify.com to flip or inspect Identity settings, never read auth tokens from ~/Library/Preferences/netlify/config.json, never probe for undocumented endpoints.
4. On failure (callback 404s, /.netlify/identity/* unreachable, OAuth flow doesn't return), surface the error, the dashboard URL, and the setting to check — then stop. Do not invent recovery commands.
5. Never build a from-scratch third-party OAuth flow when Identity is in play — no provider app registration, no client_id/secret in code, no custom callback token exchange. Use oauthLogin() + handleAuthCallback(); raw OAuth beside Identity is the single most common source of rework.
6. Server-side getUser()/login()/admin.* require modern v2 functions (export default) — v1 export { handler } is not supported. Typed Identity event handlers (UserSignupEvent, event.deny()) require @netlify/functions ≥ 5.2.0; older installs use the legacy filenames.
7. Don't hard-code which auth providers exist — call getSettings() at startup and render the signup form and OAuth buttons from what it returns.
8. Site-gating requests ("lock this site to my company", employees-only) route to the netlify-access-control skill first — Identity is the app-level user layer only.
9. Any answer that assigns or changes roles — at signup, via admin.*, or in the dashboard — must say the change takes effect on the user's next login or token refresh, not immediately. Keep that sentence next to the code that sets the role, not only in a separate JWT section: an agent answering a signup question reads the signup example and stops, and it has shipped answers that omit the delay.
10. Before setting up Identity for an internal tool, ask who signs in. If they can already pass the project's Netlify login (a private project or team login protection), the app has a verified user without Identity: read context.user in functions and edge functions and skip the second login. Identity is for users outside that Netlify login. The two never merge: context.user has no roles or app_metadata, and getUser() never returns it.