RootAuth Product Quick Start Guide

This guide helps you quickly understand the basic setup path in RootAuth. You can follow the steps below to create an application, configure the login experience, set up security policies, and complete development integration. For detailed settings, open the linked documentation in each section.

Who this is for: administrators, product owners, and developers who are using RootAuth for the first time.

 

1. Understand the RootAuth Workflow

RootAuth manages authentication capabilities by application. In most cases, a web app, mobile app, or business system corresponds to one application in RootAuth.

A typical setup flow includes:

1. Create an application and configure basic information.
2. Set up the login and sign-up pages.
3. Choose the authentication methods users can use.
4. Configure security policies and multi-factor authentication.
5. Customize branding, email, and SMS services.
6. Integrate your business system through Hosted pages, APIs, or SDKs.
7. After launch, review users, data overview, and behavior logs.

 

2. Create and Configure an Application

After entering the RootAuth console, create an application first, then configure basic information such as the application name, logo, endpoints, and callback URLs.

Useful documents:

• Application Configuration: configure application basic information, endpoints, and authentication-related settings.
• Protocol Configuration: configure OIDC grant modes, tokens, and callback-related settings.

If you are not ready to decide on protocol details, you can complete the basic application information first and return to protocol configuration before development integration.

 

3. Configure the Login and Sign-Up Experience

In Login Control, you can decide what login and sign-up pages users see, and whether users can register and log in with email, phone number, or username.

Start by confirming the following:

1. Whether login and sign-up should be separate pages or a unified page.
2. Whether users use email, phone number, or username as their account identifier.
3. Whether password login, verification code login, or both should be enabled.
4. If phone number is enabled, whether sign-up or login region codes should be restricted.

For details, see Login Control.

After configuration, click Preview Login/Sign-Up in the upper-right corner to preview the login and sign-up pages that end users will see.

 

4. Enable Third-Party Authentication

If you want users to log in with third-party accounts, enable the corresponding provider in Authentication Configuration.

The RootAuth help center currently provides configuration guides for:

• Google
• Telegram
• Facebook

After a third-party provider is enabled, the Hosted login page displays the corresponding login button based on your configuration. If you integrate through APIs, you can also build the third-party login entry in your own page.

 

5. Configure Security Policies

Before launch, configure registration security, IP policies, and multi-factor authentication according to your business risk level.

Common security documents:

• Registration Security: configure security checks and restrictions in the sign-up flow.
• IP Blacklist: block specified IP addresses from accessing authentication flows.
• IP Whitelist: allow only specified IP addresses to access authentication flows.

If your business requires stronger account protection, enable multi-factor authentication:

• Email Verification
• OTP (Authenticator App)
• SMS Verification

Multi-factor authentication mainly affects account-and-password login. Whether third-party login or verification-code login is affected depends on the specific feature documentation.

 

6. Customize Branding

Branding settings help keep authentication pages, emails, and SMS messages consistent with your product experience.

You can start with the following settings:

• Style Configuration: configure login page background, theme color, logo, and other visual styles.
• Feature Configuration: configure login page text, agreement links, language switcher, and related features.
• Third-Party Email Service: configure a custom SMTP service.
• Email Template: configure emails for sign-up, login, password reset, and other scenarios.
• Domestic SMS Service: configure SMS verification code delivery for mainland China phone numbers.
• International SMS Service: configure SMS verification code delivery for international phone numbers.

After configuration, send a test email or test SMS to confirm that provider credentials, signatures, and templates work correctly.

 

7. Integrate Your Business System

RootAuth supports Hosted integration and API / frontend framework integration. Choose the integration path that best matches your team's development approach.

Integration option	Best for	Documentation
API integration	Quickly using the login and sign-up pages hosted by RootAuth.	API Integration
Vue integration	Applications built with Vue.	Vue Integration
React integration	Applications built with React.	React Integration

If you encounter API errors during integration, see Error Code Reference.

 

8. Manage Users and Permissions

After launch, administrators can use User Management to view and manage users, organizations, and roles under the current application.

• Users: view the user list, user details, and authentication information.
• Organizations: manage organization structure.
• Roles: manage roles and permission assignment.

If you only need to verify the login and sign-up flow quickly, start with the user list and user details. Organizations and roles can be configured later during permission management.

 

9. View Data and Logs

After launch, use the application overview and audit logs to monitor user growth, login activity, and abnormal behavior.

• User Data Overview: view key user data and trends.
• User Behavior Log: view user actions such as sign-up, login, password reset, and secondary authentication.

When users report login failures, missing verification codes, or secondary verification failures, check the user behavior logs first to confirm the failure reason and time.

 

10. Recommended Launch Checklist

Before going live, complete the following checks:

1. Application name, logo, callback URL, and protocol settings are confirmed.
2. The login and sign-up pages have been previewed through Preview Login/Sign-Up.
3. Authentication methods are enabled according to business needs, such as email, phone number, or third-party login.
4. Registration security, IP policies, and multi-factor authentication are configured based on risk requirements.
5. Email and SMS services have been tested and confirmed available.
6. Development integration is complete, and the application can handle both successful and failed login scenarios.
7. Administrators know how to view user details, data overview, and user behavior logs.

After completing these steps, you can connect RootAuth authentication capabilities to your production business flow.