Email, Authentication, and Security
Configure SMTP host, port, TLS mode, optional credentials, sender identity, and the public application URL. Verification and password-reset links must use the canonical HTTPS origin.
Local development uses Mailpit at http://localhost:18025.
Sessions
Kinoder issues opaque session values through HTTP-only same-site cookies and stores only SHA-256 hashes. Configure a stable cookie name and session lifetime. Passwords are hashed with Argon2id.
Account lifecycle
Sign-up creates an unverified account. Verification provisions the personal workspace and creates a session. Recovery supports password reset, device revocation, and sign-out everywhere.
MFA and retained credentials
Use a stable random MFA_ENCRYPTION_KEY of at least 32 characters. Production should also use an independent STORAGE_CREDENTIAL_ENCRYPTION_KEY. Retained social and provider credentials remain encrypted and are never returned through read APIs.
IMAGE PLACEHOLDER - Account security Replace with the Kinoder Security settings screen showing MFA and active sessions. Recommended size: 1600 x 900 px. Use a demonstration account.