Skip to main content

Authentication

Closegram supports several ways to sign up and log in, all backed by Firebase Authentication: email and password, Google Sign-In, Apple Sign-In, and phone number with a one-time SMS code (OTP). Users can also turn on two-factor authentication for extra security, and the sign-in flow covers password resets, email verification, and registering the device for push notifications.

Each property has its own checkbox marking whether that specific piece is fully implemented and functional end to end (frontend-nextjs + backend) — update these yourself as work lands; this page won't overwrite them.

  • Sign up with email + password
  • Multi-account — stay logged into several accounts on one device and switch between them (add account / log out one / log out all); accounts stored client-side in localStorage, active token mirrored for Apollo (AccountSwitcherMenu.tsx)
  • Log in with email + password
  • Google Sign-In (via Firebase)
  • Apple Sign-In
  • Phone number + OTP (SMS code), including on iOS — the backend is ready two ways: loginWithIdToken (Firebase Phone Auth client-side, then exchange the ID token — what the web client actually uses) and the direct requestPhoneOtp/loginWithPhone pair (Twilio-backed SMS, PHONE_LOGIN_PROVIDER=twilio, no Firebase Phone Auth SDK needed client-side). Both have shared operation files ready under packages/graphql/operations/Web/Auth/. apps/ios already implements the direct pair end to end (WelcomeView's Phone button → LoginView phone mode → RequestPhoneOtpUseCase → VerifyCodeView → loginWithPhone, all the way through AuthRepository/AuthService to the real GraphQL mutations — no stub or TODO anywhere in that path)
  • Two-factor authentication via authenticator app (setup, verify, disable) — now enforced at login (a valid TOTP code or a backup code is required to complete sign-in).
  • Two-factor authentication via SMS / email — self-enrollment is wired end to end in Settings → Security: pick SMS or Email, enableTwoFactor sends a code (SMS to the entered phone number, email to the account's address), verifyTwoFactorSetup confirms it and shows backup codes, same as authenticator-app 2FA above. Login already dispatched a fresh code and required it for any account with one of these methods stored (user_two_factor) even before self-enrollment existed.
  • View and copy backup codes (shown at 2FA setup)
  • Regenerate backup codes later
  • Forgot password / reset via email link
  • Change password (while logged in)
  • Email verification
  • Passkey (WebAuthn) sign-in — register a passkey in Settings → Security and sign in with Face ID / Touch ID / a security key. On the landing screen, entering an email/username and pressing Continue silently checks whether that account has a passkey: if it does, the OS passkey prompt appears; if it does not, it goes straight to the password step (no confusing system prompt for users without a passkey). Backed by @simplewebauthn and the webauthn resolver.
  • Device token registration for push notifications, including on iOS — the backend is fully built and ready (registerDeviceToken mutation, device-token.manager.js, real persistence, tests, and the shared operation file at packages/graphql/operations/Web/DeviceTokens/RegisterDeviceToken.graphql so apollo-swift already has it); apps/ios already calls it (PushNotificationManager → DeviceTokenService.registerDeviceToken() → the real GraphQL mutation, no stub or TODO in that path)

See the technical reference for GraphQL schemas, routes, source file links, and per-field wiring status.