# Auth

Authentication (user accounts) is enabled by running the `vela enable auth` command. This will prompt for configuration options. The auth module creates all necessary code for authentication, including login, logout, sign up, password reset, email verification and more.

### Syntax

```
$ vela enable auth
```

Auth needs a [backend](/docs/enable/backend), and its pages are built from shadcn-svelte components, so the project needs [shadcn-svelte](/docs/ui) too. Without it the command is refused before anything is changed.

### Protected routes

Once enabled, a group of protected routes is automatically created, defaulting to `(app)`. Any routes placed within this group will be protected and require authentication to access. Unauthenticated users will be redirected to the login page. The protected routes and the login path for redirection can be configured in the middleware in `hooks.server.ts`, defaults shown below:

```ts
import { handlePocketbase } from '@velastack/pocketbase';

export const handle = handlePocketbase({
  auth: {
    enabled: true,
    protectedRoutes: ['/(app)'],
    loginPath: '/login'
  }
})
```

### One-time codes

Turn on OTP for the `users` collection in the PocketBase admin interface and the login and signup pages offer a one-time code sent by email, next to the password. Signing up with a code creates the account without a password, then asks for a name on `/welcome`. To sign in with a code sent on WhatsApp instead, see [`vela enable whatsapp`](/docs/enable/whatsapp).

### OAuth

OAuth is supported out of the box with PocketBase. Configure the OAuth providers in the PocketBase admin interface. Any enabled OAuth provider will be available in the authentication flow.

### Subsequent scaffolds

Once auth is enabled, subsequent scaffolded routes will automatically be created within the protected `(app)` group.

### Remote functions

`vela enable auth --remote` (vela 0.15.13 or later) generates the same flows with SvelteKit remote functions instead of form actions and sveltekit-superforms. See [Auth (remote functions)](/docs/enable/auth-remote).