You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/content/docs/workflows/example-workflows/existing-password-provided-workflow.mdx
+32-57Lines changed: 32 additions & 57 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,95 +17,70 @@ This trigger fires after an existing password is entered in the sign-in flow.
17
17
Security is at the heart of our technical decisions at Kinde, and keeping user passwords safe is a huge part of this. Therefore:
18
18
19
19
- Any attempt to log the password out to the console in this workflow will be redacted
20
-
- API calls can only be made from these workflows using the Kinde provided `secureFetch` method which secures the payload with an encryption key
20
+
- API calls should only be made from these workflows using the Kinde provided [secureFetch](/workflows/bindings/secure-fetch-binding/) binding which secures the payload with an encryption key
21
21
22
22
## Example use cases
23
23
24
24
### Drip feed migration
25
25
26
-
For gradual migrations to Kinde where you wish to check the password against an external database before creating the user in Kinde.
26
+
For gradual migrations to Kinde where you wish to check the password against an external database before creating the user in Kinde and migrating their password. [See example code](https://github.com/kinde-starter-kits/workflow-examples/blob/main/existingPassword/dripFeedMigrationWorkflow.ts)
27
27
28
28
## Workflow code
29
29
30
-
### The event object
30
+
### Sample event object
31
31
32
32
The main argument provided to your code is the Kinde workflow `event` object which has two keys `request` and `context`. This gives you access to the reason the workflow was triggered. Here's an example:
33
33
34
-
```jsx
34
+
```json
35
35
{
36
-
"request": {},
37
-
"context": {
38
-
"domains": {
39
-
"kindeDomain":"https://example.kinde.com"// Your Kinde domain
40
-
},
41
-
"auth": {
42
-
"provided email": x_provided_email, // the email provided by the user
43
-
"password":"someSecurePassword", // the raw password
44
-
"hashedPassword":"someHash", // the hashed password,
45
-
"hasUserRecordInKinde":false// whether the user exists already in Kinde
46
-
},
47
-
"user": {
48
-
"id":"kp_1234566"// only provided in password reset flows as otherwise new user
49
-
}
50
-
}
51
-
```
52
-
53
-
### Workflow settings
54
-
55
-
```jsx
56
-
exportconstworkflowSettings= {
57
-
id:"verifyPassword",
58
-
name:"Verify password",
59
-
failurePolicy: {action:"stop"},
60
-
trigger:"user:existing_password_provided",
61
-
bindings: {
62
-
"kinde.secureFetch": {}, // Required for external API calls
63
-
"kinde.widget": {} // Required to invalidate the form
36
+
"request": {},
37
+
"context": {
38
+
"domains": {
39
+
"kindeDomain": "https://example.kinde.com"// Your Kinde domain
40
+
},
41
+
"auth": {
42
+
"provided email": "[email protected]", // the email provided by the user
43
+
"password": "someSecurePassword", // the raw password
44
+
"hashedPassword": "someHash", // the hashed password,
45
+
"hasUserRecordInKinde": false// whether the user exists already in Kinde
46
+
},
47
+
"user": {
48
+
"id": "kp_1234566"// only provided in password reset flows as otherwise new user
49
+
}
64
50
}
65
-
};
51
+
}
66
52
```
67
53
68
54
### Secure fetch binding
69
55
70
-
When an API call is made using `kinde.secureFetch()` the body is automatically encrypted with the active encryption key for the workflow. This can be generated under **Workflow > Encryption keys**.
71
-
72
-
You will need to use the same encryption key in your own code to decrypt the payload on arrival. This ensures secure transfer of the password.
73
-
74
-
We handle the encryption for you so your code might look like:
We recommend you use the [secureFetch](/workflows/bindings/secure-fetch-binding/) binding to make API calls from your workflow if they include sensitive data like passwords.
88
57
89
58
### Widget binding
90
59
91
60
The `kinde.widget` binding gives you access to the Kinde widget, which is the central form on the page. In this case the form with the two password fields.
92
61
93
62
It exposes a method for invalidating a form field `invalidateFormField`
kinde.widget.invalidateFormField("p_password", "User or password not found");
73
+
}
105
74
```
106
75
107
-
The field names for this workflow are
76
+
The field names for the widget binding in this workflow are:
108
77
109
78
| Field name | Description |
110
79
| ------------ | ------------------ |
111
80
|`p_password`| The password field |
81
+
82
+
### Example workflows
83
+
84
+
See examples on GitHub:
85
+
86
+
[Drip feed migration](https://github.com/kinde-starter-kits/workflow-examples/blob/main/existingPassword/dripFeedMigrationWorkflow.ts) - Shows how to check a password against an external database before creating the user in Kinde.
Copy file name to clipboardExpand all lines: src/content/docs/workflows/example-workflows/m2m-token-generation-workflow.mdx
+11-73Lines changed: 11 additions & 73 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -26,15 +26,19 @@ You may want to add additional custom claims to the M2M token before it is deliv
26
26
27
27
### Correlate an M2M application with an organization or user
28
28
29
-
If you want, you can use M2M applications similar to API keys to enable access to various endpoints and tie them to an organization or user. For example, you add the organization code as a [custom property](/properties/work-with-properties/manage-properties/) on the M2M application, then fetch any data you’d like to include in the token.
29
+
If you want, you can use M2M applications similar to API keys to enable access to various endpoints and tie them to an organization or user. For example, you add the organization code as a [custom property](/properties/work-with-properties/manage-properties/) on the M2M application, then fetch any data you’d like to include in the token.[See example code](https://github.com/kinde-starter-kits/workflow-examples/blob/main/m2mToken/mapOrgToM2MApplicationWorkflow.ts)
30
30
31
31
## Workflow code
32
32
33
-
### The event object
33
+
### M2M token binding
34
+
35
+
The [kinde.m2mToken](/workflows/bindings/m2m-token-binding/) binding is used to modify claims in the generated access token.
36
+
37
+
### Sample event object
34
38
35
39
The main argument provided to your code is the Kinde workflow `event` object which has two keys `request` and `context`. This gives you access to the reason the workflow was triggered. Here's an example:
36
40
37
-
````jsx
41
+
```json
38
42
{
39
43
"request": {
40
44
"auth": {
@@ -53,76 +57,10 @@ The main argument provided to your code is the Kinde workflow `event` object whi
53
57
"trigger": "m2m:token_generation"
54
58
}
55
59
}
60
+
```
56
61
57
-
### Workflow settings
58
-
59
-
```jsx
60
-
export const workflowSettings = {
61
-
id: "m2mTokenGeneration",
62
-
name: "M2M custom claims",
63
-
failurePolicy: {
64
-
action: "stop",
65
-
},
66
-
trigger: "m2m:token_generation",
67
-
bindings: {
68
-
"kinde.m2mToken": {}, // required to modify M2M access token
69
-
"kinde.fetch": {}, // Required for external API calls
70
-
"kinde.env": {}, // required to access your environment variables
71
-
url: {}, // required for url params
72
-
},
73
-
};
74
-
````
75
-
76
-
### M2M token binding
77
-
78
-
The `kinde.m2mToken` binding is used to modify claims in the generated access token.
79
-
80
-
### A simple example
62
+
### Example workflows
81
63
82
-
```jsx
83
-
kinde.m2mToken.setCustomClaim("hello", "world");
84
-
```
64
+
See examples on GitHub:
85
65
86
-
### An advanced example using Kinde API to correlate an organization to an M2M application.
[Map M2M applications to organizations](https://github.com/kinde-starter-kits/workflow-examples/blob/main/m2mToken/mapOrgToM2MApplicationWorkflow.ts) - Shows how to map M2M applications to organizations. Useful if using Kinde for B2B API key management
Copy file name to clipboardExpand all lines: src/content/docs/workflows/example-workflows/new-password-provided-workflow.mdx
+31-40Lines changed: 31 additions & 40 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -17,7 +17,7 @@ This trigger fires after a new password is entered in either the sign-up flow or
17
17
Security is at the heart of our technical decisions at Kinde, and keeping user passwords safe is a huge part of this. Therefore:
18
18
19
19
- Any attempt to log the password out to the console in this workflow will be redacted
20
-
- API calls can only be made from these workflows using the Kinde provided `secureFetch` method which secures the payload with an encryption key
20
+
- API calls should only be made from these workflows using the Kinde provided [secureFetch](/workflows/bindings/secure-fetch-binding/) binding which secures the payload with an encryption key
21
21
22
22
## Example use cases
23
23
@@ -29,21 +29,21 @@ As a baseline, Kinde runs the following password checks:
29
29
- The password is at least 8 characters long
30
30
- The password does not exist in the 1,000,000 most common passwords
31
31
32
-
With this workflow you can add your own custom code to run additional checks, for example if your business requires a specific mix of upper / lower case characters, or inclusion of special characters.
32
+
With this workflow you can add your own custom code to run additional checks, for example if your business requires a specific mix of upper / lower case characters, or inclusion of special characters.[See example code](https://github.com/kinde-starter-kits/workflow-examples/blob/main/existingPassword/customPasswordValidationWorkflow.ts)
33
33
34
-
### Sync password with an external system
34
+
### Sync password updates with an external system
35
35
36
36
For gradual migrations to Kinde where several apps are in play (e.g. a mobile application and a web application), you might want to migrate web users first and mobile app users later. If users have access to both applications, then password resets on the web application would not be persisted to the legacy mobile app password store.
37
37
38
-
With this workflow you can securely send the password to your mobile app system in order to keep them in sync.
38
+
With this workflow you can securely send the password to your mobile app system in order to keep them in sync.[See example code](https://github.com/kinde-starter-kits/workflow-examples/blob/main/newPassword/securelySyncPasswordWorkflow.ts)
39
39
40
40
## Workflow code
41
41
42
-
### The event object
42
+
### Sample event object
43
43
44
44
The main argument provided to your code is the Kinde workflow `event` object which has two keys `request` and `context`. This gives you access to the reason the workflow was triggered. Here's an example:
45
45
46
-
```jsx
46
+
```json
47
47
{
48
48
"request": {},
49
49
"context": {
@@ -54,63 +54,54 @@ The main argument provided to your code is the Kinde workflow `event` object whi
54
54
"firstPassword": "someSecurePassword", // the first password entered
55
55
"secondPassword": "someSecurePassword", // password match field
56
56
"newPasswordReason": "reset"| "initial" // whether it is registration or reset
57
-
}
57
+
},
58
58
"user": {
59
-
"id":"kp_1234566"// only provided in password reset flows as otherwise new user
59
+
"id": "kp_1234566",// only provided in password reset flows as otherwise new user
"kinde.secureFetch": {}, // Required for external API calls
77
-
"kinde.widget": {} // Required to invalidate the form
78
-
}
79
-
};
80
-
```
66
+
## Bindings
81
67
82
68
### Secure fetch binding
83
69
84
-
When an API call is made using `kinde.secureFetch()` the body is automatically encrypted with the active encryption key for the workflow. This can be generated under **Workflow > Encryption keys**.
85
-
86
-
You will need to use the same encryption key in your own code to decrypt the payload on arrival. This ensures secure transfer of the password.
87
-
88
-
We handle the encryption for you so your code might look like:
70
+
We recommend you use the [secureFetch](/workflows/bindings/secure-fetch-binding/) binding to make API calls from your workflow if they include sensitive data like passwords.
89
71
90
72
### Widget binding
91
73
92
74
The `kinde.widget` binding gives you access to the Kinde widget which is the central form on the page. In this case the form with the two password fields.
93
75
94
76
It exposes a method for invalidating a form field `invalidateFormField`.
| `p_password_2` | The second password field, typically to check it matches the first to help prevent typos |
106
+
-[Sync passwords to another system](https://github.com/kinde-starter-kits/workflow-examples/blob/main/newPassword/securelySyncPasswordWorkflow.ts) - Use encryption keys to securely keep passwords in sync between systems.
107
+
-[Custom password validation](https://github.com/kinde-starter-kits/workflow-examples/blob/main/newPassword/customPasswordValidationWorkflow.ts) - Shows how to validate a password against your own rules.
0 commit comments