netlify/context-and-tools/netlify-identity

Netlify Identity

Use @netlify/identity (npm). For new projects it replaces the legacy netlify-identity-widget and gotrue-js. Do not reach for those.

npm install @netlify/identity

Framework examples (Next.js/Astro/Remix/SvelteKit) and the full API reference are in the `@netlify/identity` README on npm.

Identity does not run under `netlify dev`. Test all auth flows on a deploy. Deploy Previews work. Local dev will not complete signup/login/OAuth.

Identity config is dashboard-only. There is no public API. Never curl api.netlify.com to flip or read Identity settings, never read tokens from local Netlify config, and never probe undocumented endpoints. Enable and configure Identity at https://app.netlify.com/projects/{site_name}/identity.

Never build a from-scratch OAuth flow alongside Identity. No provider app registration in code, no client_id/secret in source, and no custom callback token exchange. Use oauthLogin() + handleAuthCallback(). Raw OAuth beside Identity is the most common source of rework.

Client auth (browser)

import { signup, login, logout, getUser, oauthLogin, handleAuthCallback } from '@netlify/identity'
// Register — confirmation email sent by default (unless autoconfirm is on)
const user = await signup('jane@example.com', 'securepassword', { full_name: 'Jane Doe' })
// Log in / out
await login('jane@example.com', 'securepassword')
await logout()
// Current user or null
const current = await getUser()
if (current) console.log(`Logged in as ${current.email}`)
// External provider — redirects the browser; provider is one of
// 'google' | 'github' | 'gitlab' | 'bitbucket'
oauthLogin('github')

`handleAuthCallback()` is mandatory on your landing page. Without it, OAuth redirects, email-confirmation links, password-recovery links, and invite links never complete. Call it on page load.

Invites are NOT logged in by `handleAuthCallback()`. For an invite it returns type === 'invite' with the token in result.token and result.user === null. The account does not exist yet. You must collect a password and call acceptInvite(result.token, password). If you skip this step, invited users never get an account.

import { handleAuthCallback, acceptInvite } from '@netlify/identity'
const result = await handleAuthCallback() // falsy if no token in URL hash
if (result?.type === 'invite' && result.token) {
  // Invited user has no account yet. Ask them to choose a password first.
  const password = (document.getElementById('password') as HTMLInputElement).value
  const user = await acceptInvite(result.token, password)
  console.log('Account created:', user.email)
} else if (result) {
  // OAuth, email confirmation, recovery, or email change
  console.log(result.type, result.user?.email)
}

For recovery tokens you can call recoverPassword() directly instead. Refresh a session with refreshSession().

Don't hard-code which providers exist. Call getSettings() at startup and render the signup form and OAuth buttons from what it returns.

Server-side auth (Netlify Functions & Edge Functions)

Server-side getUser()/login()/admin.* require modern v2 functions (export default). The v1 export { handler } form is not supported.

getUser() works in both runtimes. `admin.*` runs ONLY in Netlify Functions. It does not run in the browser or in Edge Functions.

// netlify/functions/me.ts — verify user
import { getUser } from '@netlify/identity'
import type { Context } from '@netlify/functions'
export default async (req: Request, context: Context) => {
  const user = await getUser()
  if (!user) return new Response('Unauthorized', { status: 401 })
  return Response.json({ id: user.id, email: user.email })
}

The Edge Function form is identical but imports Context from @netlify/edge-functions.

Role checks

// netlify/functions/admin-users.ts
import { getUser, admin } from '@netlify/identity'
import type { Context } from '@netlify/functions'
export default async (req: Request, context: Context) => {
  const user = await getUser()
  if (!user) return new Response('Unauthorized', { status: 401 })
  if (!user.roles.includes('admin')) return new Response('Forbidden', { status: 403 })
  const users = await admin.listUsers()
  return Response.json({ users })
}

CSRF: required for server-side auth endpoints

Any endpoint that runs login(), signup(), or logout() server-side must call verifyRequestOrigin(req) at the top of the handler. It throws a 403 on origin mismatch.

// netlify/functions/login.ts
import { login, verifyRequestOrigin } from '@netlify/identity'
import type { Context } from '@netlify/functions'
export default async (req: Request, context: Context) => {
  verifyRequestOrigin(req)
  const { email, password } = await req.json()
  await login(email, password)
  return new Response(null, { status: 302, headers: { Location: '/dashboard' } })
}

Identity event functions

The platform calls your handler when an Identity event occurs. Export a default object with a method per event. File: netlify/functions/identity.mts.

Typed handlers (UserSignupEvent, event.deny()) require @netlify/functions ≥ 5.2.0. Older installs must use the legacy filename convention (identity-signup.ts, etc.). See references/authorization-and-sessions.md.

Event user fields are camelCase (appMetadata, userMetadata, confirmedAt).

// netlify/functions/identity.mts — deny a signup
import type { UserValidateEvent } from "@netlify/functions"
export default {
  userValidate(event: UserValidateEvent) {
    if (!event.user.email?.endsWith("@example.com")) return event.deny()
  },
}

// netlify/functions/identity.mts — assign roles at signup
import type { UserSignupEvent } from "@netlify/functions"
export default {
  userSignup(event: UserSignupEvent) {
    return { user: { ...event.user, appMetadata: { ...event.user.appMetadata, roles: ["member"] } } }
  },
}

• event.deny() rejects the action. The end user gets a 401, and no error appears in observability. The first handler to call it aborts the chain, and later subscribers are not invoked. Legacy filename functions signal denial with a non-2xx Response instead.
• Return { user: {...} } to modify the record before it is persisted. This is the canonical way to set roles at signup. Roles ride in the JWT, so a role change takes effect on the user's next login or token refresh, not immediately. See Roles & the JWT below.
• Background mode: export const config: Config = { background: true }. The action completes immediately and the handler runs asynchronously.

Roles & the JWT

• user.roles is read from app_metadata.roles and carried in the JWT (cookie nf_jwt; refresh via nf_refresh).
• user_metadata holds the user-editable profile (full_name, email). app_metadata holds app data, including roles, and is not user-editable.

Role changes are NOT immediate. They take effect on next login or token refresh. Changing roles does not invalidate the current JWT. Force a refresh with refreshSession().

Set roles for existing users via admin.updateUser() in a Netlify Function. Set them at signup via the userSignup event handler above.

Deep guides for SSR/session hydration and authorization live in references/advanced-patterns.md and references/authorization-and-sessions.md.

CDN-edge RBAC (redirect rules)

Enforced at the edge with no origin round trip. A mismatched role gets a 404 unless you add a fallback. Always pair a role-gated rule with a fallback.

_redirects:

/admin/*  /admin/:splat  200!  Role=admin
/admin/*  /login         401!
# Multiple roles chained with commas:
/private/* /private/:splat 200! Role=editor,admin

netlify.toml:

[[redirects]]
  from = "/admin/*"
  to = "/admin/:splat"
  force = true
  status = 200
  conditions = {Role = ["editor", "admin"]}

Use redirect rules for path-based gating. Use function-based user.roles checks for custom authorization logic.

Configuration (dashboard-only)

Base: https://app.netlify.com/projects/{site_name}/identity. Enable with Enable Identity. Identity requires HTTPS, so set up SSL before integrating on a custom domain.

• Registration (?tab=registration#registration-preferences): Open (default; anyone can sign up) or Invite only (all users, including external-provider logins, must be invited first).
• Confirmation / autoconfirm (?tab=emails#confirmation-template): check the box to skip email verification.
• External providers (?tab=registration#external-providers): Google/GitHub/GitLab/Bitbucket. For branded OAuth (your app name instead of "Netlify Identity"), register your app with the provider, get a client ID and secret, and enter them in the Netlify settings UI, not in code.
• Invitations (?tab=users): enter addresses to send invites. The link carries invite_token. Complete it with handleAuthCallback() + acceptInvite(token, password) as shown above.
• Password recovery: on the user page, use Send reset password email. The link carries recovery_token.

Emails (Pro plans or higher)

The default sender is no-reply@netlify.com. A custom SMTP sender and custom templates both require Pro plans or higher.

Template variables (Go syntax): {{ .Email }}, {{ .NewEmail }} (email-change only), {{ .SiteURL }}, {{ .ConfirmationURL }}, {{ .Token }}.

Custom-link hash fragments per action:

{{ .SiteURL }}/path/#invite_token={{ .Token }}
{{ .SiteURL }}/path/#confirmation_token={{ .Token }}
{{ .SiteURL }}/path/#recovery_token={{ .Token }}
{{ .SiteURL }}/path/#email_change_token={{ .Token }}

Custom template constraints:

• Inline CSS only.
• Absolute image links.
• No `<html>`/`<head>`/`<body>` tags.
• Ensure your build doesn't alter Go template variables.

Audit log (Pro plans or higher)

?tab=audit-log. Search with a scoped term: author:[string] or action:[string].

Action names: login, logout, user_signedup, user_deleted, user_modified, token_revoked, token_refreshed, user_recovery_requested, user_invited.

External JWT providers (Enterprise)

Available on Enterprise plans. You may use Netlify Identity OR an external JWT provider, not both at once. You cannot authenticate third-party JWTs while Netlify Identity is enabled.

• Roles path: Netlify Identity uses app_metadata.roles; an external provider uses app_metadata.authorization.roles. For a custom path, contact support.
• The JWT header must be {"alg": "HS256", "typ": "JWT"} (HS256 required). The payload exp is required and must be a future Unix Epoch time.
• Set the JWT secret at Project configuration > General > Visitor access > JWT secret. Project-level settings override team-level defaults.

On failure — stop, don't guess

If callbacks 404, /.netlify/identity/* is unreachable, or an OAuth flow never returns:

1. Surface the error.
2. Give the dashboard URL (https://app.netlify.com/projects/{site_name}/identity).
3. Name the setting to check (registration preference, external provider config, confirmation/autoconfirm).
4. Then stop. Do not invent recovery commands.

Remember: Identity does not work under netlify dev. Confirm you are testing on a deploy.