Skip to main content

​
Authentication Methods

clarife supports multiple authentication methods to balance security and convenience.
MethodDescription
Email + passwordTraditional sign-in with email and password
Magic linkPasswordless sign-in via a link sent to your email
Google OAuthSign in with your Google account
Apple OAuthSign in with your Apple ID
GitHub OAuthSign in with your GitHub account

​
Email + Password

The standard authentication method:
  • Minimum 8 characters required
  • Passwords are hashed using bcrypt (never stored in plain text)
  • Password reset via email link
  • Change password anytime in Settings
clarife uses bcrypt with a high cost factor for password hashing, making brute-force attacks computationally impractical.
Passwordless authentication for quick access:
1

Enter your email

On the sign-in page, enter your email and choose Send magic link.
2

Check your inbox

A one-time link is sent to your email address.
3

Click the link

Click the link to sign in. No password needed. The link expires after 1 hour.

​
OAuth Providers

Connect third-party accounts for one-click sign-in:
ProviderWhat is shared
GoogleEmail, display name, avatar
AppleEmail (private relay option available)
GitHubEmail, username, avatar
You can connect multiple OAuth providers to the same clarife account. Go to Settings > Security > Connected Accounts to manage connections.

​
Two-Factor Authentication (2FA)

Add a second layer of security with TOTP (Time-based One-Time Password):
FeatureDetails
ProtocolTOTP (RFC 6238)
Code length6 digits
Code interval30 seconds
Recovery codesProvided at setup
Compatible appsGoogle Authenticator, Authy, 1Password, Bitwarden
See Security Settings for setup instructions.
When 2FA is enabled, you must enter a TOTP code on every sign-in. Keep your recovery codes in a safe place in case you lose access to your authenticator.

​
Session Security

FeatureDetails
Session tokensSecure, HttpOnly cookies
Session durationRefreshed automatically while active
New device detectionLogin alerts sent for unrecognized devices
Concurrent sessionsMultiple devices supported simultaneously
Yes. You can have a password, magic link, and multiple OAuth providers all active on the same account. Use whichever is most convenient.
Yes. Apple allows you to use a private relay email that forwards to your real address. clarife sees only the relay address unless you choose to share your real email.
Click Forgot password on the sign-in page. A password reset link is sent to your email. You can also use magic link or OAuth to sign in without a password.
2FA is applied to email/password and magic link sign-ins. OAuth providers manage their own 2FA independently. We recommend enabling 2FA on both your clarife account and your OAuth provider.