The fourth of six Dashboard Guide pages. Covers everything that changes how your project behaves: Settings, Authentication, the risk-policy sub-page under Security, Customise, and BYOAM.
Genuinely thin, as flagged before: project rename, the project ID, and a Danger Zone — nothing else lives here. Deleting a project is owner-only and requires your company to have more than one project (the button is disabled with an explanatory tooltip otherwise); confirming requires typing the project's exact name.
One fact worth stating precisely, since it isn't documented anywhere else and the dashboard's own copy is misleading about it: the delete confirmation says this "permanently deletes this project and all associated users, sessions, API keys, and auth events." Checking the actual database foreign keys, that's only true for API keys (ON DELETE CASCADE — genuinely, permanently deleted). Users, sessions, passkeys, and auth events are not deleted — their foreign keys are ON DELETE SET NULL, so those rows survive with their project_id cleared. They're orphaned, not destroyed: no longer reachable through any dashboard view once the project is gone, but still present in the underlying data.
This is the page that actually controls what your integration can do — and it's worth stating plainly, tying back to the Monitoring page: this is where Auth Methods is actually reachable from. Security's own page links to Passkeys and risk-policy Settings, but never to Auth Methods, even though the URL lives right alongside them (security/auth-methods). The only real path there is the "Enabled Auth Methods" card on this page.
Below that are Allowed Origins and Passkey RP Domain — the one-time setup passkey and magic link both need before they'll work. The full mechanics (why each is required, what's validated, why localhost is fine for one and categorically rejected for the other) are already covered in depth on Passkey-first & smart fallback — this page is just where you configure it, not a second explanation of why. Worth knowing: the limit is 10 origins per project, not shared across every project your company owns — the on-page banner's copy matches this now (it previously said "per company," which didn't match the real enforcement; fixed).
Also worth knowing: the SDK's own client-side methods array (passed when constructing Threshold1) is advisory only. The "Enabled Auth Methods" toggle on this page is the real, server-side enforcement gate — a method your SDK config lists but this project hasn't enabled will be rejected regardless of what the client asked for.
Three policies, unchanged from the risk engine's original design: Monitor (score and flag, no friction — score 31+ is allowed but flagged), Challenge (step-up OTP for 31–60, block 61+ — the recommended default), and Block (allow everything through 60, block 61+, no challenge step at all). Changing this is a plain radio choice with a Save button; the page also links directly to Auth Methods, same as the main Authentication page does.
Controls how OTP and magic-link emails actually look — and, worth correcting here: despite this being shipped and fully wired end-to-end, none of these fields are currently documented anywhere else in this docs site (checked the Methods Reference pages for Email OTP and Magic Link directly — neither mentions them), so here's what's real:
The dashboard UI for registering your own auth method — the pattern mechanics themselves, including which one is actually consulted during a real login, are already covered on BYOAM; this is just what the Register Method form actually asks for: a unique Method Name, a Pattern choice (confirm_callback or verify_webhook — a webhook URL field only appears for the latter), and a self-attested Assurance Level slider (0–100, defaulting to 50). The generated secret is shown exactly once, same as an API key. Registrations aren't hard-deleted from this page — they're Deactivated. Each has its own Test action, but be precise about what it proves: for a verify_webhook (Pattern B) registration, Test only confirms your endpoint is reachable and answers in the right shape — it does not mean the method is consulted during a real login, because today, nothing is.