Concepts
This page explains the main parts of Authentication.
End users
An end user is a person who signs up in your app. End users sign in to your frontend. Dashboard users manage content in the admin.
Each end user has:
- Password hash
- Optional display name
- Optional
email_verified_at - Optional metadata
- Suspension state
If you suspend a user, that user cannot sign in. Existing access tokens for that user stop working.
Access tokens and refresh tokens
After a successful sign-in or signup, Elmapi returns:
| Field | Meaning |
|---|---|
access_token | Short-lived JWT for authenticated auth routes |
refresh_token | Longer-lived token used to get a new access token |
expires_at | Access token expiry |
refresh_token_expires_at | Refresh token expiry |
user | Current user object |
Default lifetimes:
- Access token: 15 minutes (
PROJECT_AUTH_ACCESS_TOKEN_TTL_MINUTES) - Refresh token: 30 days (
PROJECT_AUTH_REFRESH_TOKEN_TTL_DAYS)
Access tokens carry identity scopes only (openid profile email). Responses do not include CMS abilities.
Sessions
Each successful sign-in creates a backend session. Sign-out revokes that session.
Clearing browser cookies alone is not enough. Call logout so the backend session ends.
Elmapi limits sessions per user. The default is 25 (PROJECT_AUTH_MAX_SESSIONS_PER_USER). When a user exceeds the limit, Elmapi revokes the oldest sessions.
Headers
Most Authentication routes need:
project-id: YOUR_PROJECT_UUIDAuthenticated routes also need:
Authorization: Bearer ACCESS_TOKENThe introspect route for user API keys uses a project API token with the introspect ability. See User API keys.
Rate limits and lockout
Authentication routes have their own rate limits. Defaults include:
| Action | Default limit |
|---|---|
| Signup | 10 per minute |
| Sign-in | 20 per minute |
| Refresh | 120 per minute |
| Verification resend | 20 per minute |
| Verification confirm | 60 per minute |
After 5 failed sign-in attempts, Elmapi locks that email and IP for 300 seconds by default.
Audit log
Elmapi records auth events in the project audit log. You can review signup, login, logout, verification, and key events in the dashboard.