Sign-in methods

Email code or link

On every plan, and on by default. The user types their email address and gets a 6-digit code and a one-tap link. Codes are single use, expire after 10 minutes, are stored hashed and are never logged.

The link opens a confirm button, and only that click signs in, so mail filters that open links in advance can’t use them up. A code or link only finishes sign-in in the browser that asked for it; opened on another device, the link shows the code to type into the original browser.

Every visitor sees the same “check your email” step, whether or not they have an account and whether or not they’re allowed to sign up; when they aren’t, nothing is sent. After 10 wrong codes in an hour, that address can’t check codes for an hour, doubling on each repeat. Links still work during a lockout, so a locked-out user always has a way in.

The sending address

By default, sign-in email comes from signin.honkio.ca, HonkIO’s dedicated sign-in mail subdomain, with your app’s name as the sender name. It’s sent through AWS in Montréal.

If your account has a verified email sending domain, you can send sign-in email from it instead: choose it under Methods in the dashboard, or set send_from_email_domain_id. You already manage DNS for the app, so it’s a small step, and recipients see your own domain.

Text-message codes

Pro and Business. The field becomes “Email or mobile number”, and users can get a 6-digit code by text. Texts come from your own HonkIO number, never a shared one, and name your app.

Text sign-in accepts Canadian mobile numbers only; other numbers are refused with the same wording as everything else. Every protection of /v1/verify applies, along with a daily text spending limit (see Abuse protection). A STOP reply follows your number’s opt-out handling. Each text costs HonkIO’s normal SMS rate, with no verification fee.

Getting a number for texts

1. Buy a HonkIO number (Phone numbers). A toll-free number needs toll-free verification first.
2. Verify your account’s mobile number if you haven’t: a live number purchase and every live send need it. Only a toll-free number also needs a verified business, for its toll-free verification.
3. Set the number as the app’s sms_from_number_id and turn on texts_enabled. The dashboard walks you through these steps when you switch texts on. A test app needs none of this: it sends no texts, so it can turn on texts_enabled with no number.

Passkeys

On every plan, and on by default. Users sign in with Face ID, Touch ID, Windows Hello, Android or a security key, through the “Sign in with a passkey” button or the browser’s autofill. User verification (biometrics or a PIN) is always required, and a passkey sign-in counts as both steps of two-step verification.

After a code sign-in, the page offers to save a passkey. This prompt can’t be turned off: passkeys are the strongest defence against account takeover. Adding a passkey needs a sign-in within the last 10 minutes.

By default, a passkey is tied to your whole domain (acme.ca), so users keep it if you later run sign-in elsewhere on that domain; the trade-off is that your other subdomains could ask for it. Set passkey_scope to hostname to tie passkeys to the sign-in hostname alone. Credentials are kept per app: a passkey for one app never signs in to another.

Phone numbers need a backup

Carriers recycle phone numbers, so a phone-only account isn’t allowed. A user who signs up with a phone number must add a passkey or an email before sign-up finishes. If an account hasn’t been used for 6 months or more, a text code alone isn’t enough: the user also confirms by email or passkey.

The hosted page

You choose the logo, the brand colour, the app name and which methods are on, and nothing else: you can’t add HTML, CSS or JavaScript. At least one method stays on. Logos are re-encoded to PNG or WebP (SVG isn’t accepted) and served from a separate origin used only for static files. App names are checked like the app_name of /v1/verify, and names close to a protected brand go to review or are refused with AUTH_APP_NAME_PROTECTED.

The page comes in English and French: it follows the browser’s language, accepts ui_locales, and has an EN/FR toggle. Its footer always reads “Secured by HonkIO”, on every plan, and links to a short page on where data is stored and processed.

Test identifiers

Test apps send nothing. Sign in to one with the code 000000 and a reserved test identifier:

• any address at test.honkio.ca or one of its subdomains, such as ada@test.honkio.ca or ada@acme.test.honkio.ca;
• a number in the fictional 555-0100 to 555-0199 range, such as +1 416 555 0123.

Real addresses and numbers can sign in to a test app with a passkey only, so pointing production at a test app by mistake never lets anyone in as someone else.