> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spitzli.cloud/llms.txt
> Use this file to discover all available pages before exploring further.

# Identity and authentication providers

> Understand managed sign-in, Core security and retained protocol compatibility.

Spitzli Cloud uses Neon Managed Auth for all users' first-factor authentication. Core retains canonical local user IDs, tenant memberships, authorization, MFA and passkey controls. Neon sign-in alone does not grant workspace or operator access.

## Session and security boundary

Core binds a managed provider session to the exact local identity and checks that binding on subsequent requests. Disabled mappings, revoked provider sessions, expired local sessions and account restrictions deny access. Accounts with MFA enabled must complete Core's security step; operators require MFA. Existing MFA enrollment and local IDs remain part of the Core security boundary.

The Console uses a server-side authorization-code exchange with PKCE. Signed browser cookies contain opaque references; provider credentials and OAuth tokens stay server-side. Password, security and passkey screens use the canonical account origin.

## Compatibility

Older Better Auth and Clerk adapters remain historical compatibility code and migration records. Their environment settings are not the current hosted sign-in setup. Do not enable them to bypass a managed identity mapping, link accounts by email or copy an old role projection into current authority.

Existing OAuth issuer, registered clients, Studio resource audiences and website SSO contracts remain stable. The move to Neon Managed Auth does not turn a Neon credential into a Spitzli Cloud API token. See [authentication](https://docs.spitzli.cloud/developers/authentication.md).

## Source

The current implementation is in native identity (`crates/identity`), managed-session checks (`crates/identity/src/neon.rs`), all-user policy migration (`crates/persistence/migrations/0070_neon_all_users.sql`) and first-party browser sessions (`crates/browser-session`). Older README migration notes can predate this managed-auth implementation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.