---
title: "Update authentication configuration"
method: PUT
path: "/api/auth/config"
tags: ["Admin"]
---

# Update authentication configuration

`PUT /api/auth/config`

Update authentication settings (admin only)

## Request body

- object
  - `requireEmailVerification` boolean — Enabling this requires custom SMTP or a managed email provider.
  - `passwordMinLength` integer
  - `requireNumber` boolean
  - `requireLowercase` boolean
  - `requireUppercase` boolean
  - `requireSpecialChar` boolean
  - `verifyEmailMethod` 'code' | 'link' — Method for email verification (code = 6-digit OTP, link = magic link)
  - `resetPasswordMethod` 'code' | 'link' — Method for password reset (code = 6-digit OTP + exchange flow, link = magic link)
  - `allowedRedirectUrls` string[] — List of allowed URLs for authentication redirects. If empty, all redirects are allowed for smoother development UX. This is not recommended in production.
  - `disableSignup` boolean — When true, public sign-up endpoints (POST /api/auth/users and first-time OAuth) are rejected with 403 AUTH_SIGNUP_DISABLED. Admin-authenticated user creation is unaffected.

## Response `200`

Configuration updated successfully

- object
  - `id` string, uuid
  - `requireEmailVerification` boolean
  - `passwordMinLength` integer
  - `requireNumber` boolean
  - `requireLowercase` boolean
  - `requireUppercase` boolean
  - `requireSpecialChar` boolean
  - `verifyEmailMethod` 'code' | 'link'
  - `resetPasswordMethod` 'code' | 'link'
  - `allowedRedirectUrls` string[] — List of allowed URLs for authentication redirects. If empty, all redirects are allowed for smoother development UX. This is not recommended in production.
  - `disableSignup` boolean — When true, public sign-up endpoints (POST /api/auth/users and first-time OAuth) are rejected with 403 AUTH_SIGNUP_DISABLED. Admin-authenticated user creation is unaffected.
  - `createdAt` string, date-time
  - `updatedAt` string, date-time

## Other responses

- `400` — Invalid request, or no email provider is configured when enabling email verification
- `401` — Unauthorized
- `403` — Forbidden - Admin only

---

[API](https://skmtc.net/insforge/apis/insforge-authentication-api.md) · [All operations](https://skmtc.net/insforge/apis/insforge-authentication-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/insforge/insforge-authentication-api/versions/a935bb49f932/schema)