# Update login methods

Updates login methods of a specific application. Note: Fields that are objects cannot be partially updated, since the new value you set will just replace the current one. <br><br>**Required permissions**: `apps:edit`, `*:edit`, `config:edit`, `authentication-methods:edit`, `[appId]:edit`.

Endpoint: PUT /loginPreferences/{appId}/authMethods
Security: ClientAccessToken

## Path parameters:

  - `appId` (string, required)
    ID of the application to update auth methods for

## Request fields (application/json):

  - `email` (object)
    Email magic link login configuration

  - `email.expiresIn` (number, required)
    Number of minutes until the email link/code expires

  - `email.linksPerUser` (number, required)
    Allowed magic links to send a user per minute

  - `email.message` (object, required)

  - `email.message.primaryColor` (string, required)
    Primary color of the email, specified as a Hex color

  - `email.message.from` (string)
    Origin of the email message

  - `email.message.subject` (string)
    Subject of the email message

  - `email_otp` (object)
    Email one time password login configuration

  - `email_otp.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `email_otp.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `email_otp.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `email_otp.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `email_otp.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `sms` (object)
    SMS one time password login configuration

  - `sms.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `sms.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `sms.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `sms.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `sms.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `password` (object)
    Password login configuration

  - `password.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `password.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `password.lockoutTiers.attempts` (number, required)
    Number of failed attempts before this tier is triggered
    Example: 3

  - `password.lockoutTiers.duration` (number, required)
    Lockout duration in minutes for this tier
    Example: 15

  - `password.resetValidityMinutes` (number, required)
    Number of minutes until reset password token/OTP expires.
    Example: 5

  - `password.passwordComplexity` (number, required)
    Password complexity. Must be between 1 and 5.
    Example: 5

  - `password.passwordMinLength` (number, required)
    Minimum required length of the password.
    Example: 14

  - `password.blockPreviousPasswords` (number, required)
    Number of most recent passwords to block the user from setting as their new password.
    Example: 0

  - `password.checkHibp` (boolean)
    Check password updates against HIBP.

  - `password.checkDictionary` (boolean)
    Check password updates against a predefined dictionary.

  - `password.passwordExpiresIn` (number, required)
    Number of days until the password expires. Must be between 1 and 1096 days (3 years).
    Example: 90

  - `password.ignoreExpiration` (boolean)
    Ignore password expiration. If true, the password will never expire.

  - `password.maxPasswordFailures` (number)
    Number of wrong password attempts allowed before the user is suspended. Must be between 1 and 20.
    Example: 5

  - `password.passwordSuspensionDuration` (number)
    Number of minutes to suspend the user from authenticating using password after the maximum number of allowed failed attempts is exceeded. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `password.tempPasswordValidityHours` (number)
    Number of hours until temporary passwords are considered expired. Must be between 1 and 8760 hours (1 year).
    Example: 24

  - `password.requireMFA` (boolean)
    Require multi-factor authentication for password reset flows.

  - `password.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `password.notifyOnPasswordUpdate` (boolean)
    Send email to end-user upon password update

  - `totp` (object)
    TOTP login configuration

  - `totp.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `totp.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `totp.algorithm` (string)
    The algorithm used to generate the TOTP code
    Enum: "sha1", "sha256", "sha512"

  - `totp.digits` (number)
    Number of digits in the generated TOTP code, must be 6 or 8
    Example: 6

  - `totp.period` (number)
    Number of seconds in which the TOTP code is valid
    Example: 30

  - `totp.window` (number)
    Number of windows to check for valid TOTP codes
    Example: 2

  - `totp.issuer` (string)
    TOTP issuer
    Example: My Company

  - `totp.maxFailures` (number)
    Number of wrong TOTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `totp.lockoutDuration` (number)
    TOTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `totp.maxTotpPerUser` (number)
    Maximum number of TOTP authenticators allowed per user. Must be between 1 and 50.
    Example: 1

  - `pin_authenticator` (object)
    PIN authenticator login configuration

  - `pin_authenticator.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `pin_authenticator.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `pin_authenticator.maxFailures` (number)
    Number of wrong PIN Authenticator attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `pin_authenticator.lockoutDuration` (number)
    PIN Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `face` (object)
    Face authenticator login configuration

  - `face.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `face.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `face.maxFailures` (number)
    Number of wrong Face Authenticator attempts allowed. Must be between 1 and 20.
    Example: 3

  - `face.lockoutDuration` (number)
    Face Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `face.saveImageEmbedding` (boolean)
    Enables saving the image embedding

  - `webauthn_api` (object)
    WebAuthn API login configuration

  - `webauthn_api.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `webauthn_api.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `webauthn_api.rpId` (string, required)
    Domain to which WebAuthn credentials are registered and used to authenticate (e.g., example.com)

  - `webauthn_api.rpWebOrigins` (array)
    A list of Web origins that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `webauthn_api.rpMobileOrigins` (array)
    A list of mobile origins that will be used to request registration and authentication. The origin must match the domain of the RP ID.

  - `webauthn_api.replaceExistingPasskey` (boolean)
    Set to true in order to replace the existing passkey. Default is False.

  - `webauthn_api.maxFailures` (number)
    Number of wrong attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `webauthn_api.lockoutDuration` (number)
    Lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `webauthn_api.allowSyncedPasskeys` (boolean)
    Allow synced passkeys

  - `webauthn_api.enforceAttestation` (boolean)
    Enforce attestation for device-bound passkeys

  - `webauthn_api.attestationType` (string)
    Attestation conveyance preference (none, indirect, or direct)
    Enum: "none", "indirect", "direct"

  - `webauthn_api.aaguidAllowList` (array)
    List of allowed AAGUIDs (Authenticator Attestation GUIDs). If specified, only authenticators with these AAGUIDs will be accepted. Mutually exclusive with aaguidBlockList.

  - `webauthn_api.aaguidBlockList` (array)
    List of blocked AAGUIDs (Authenticator Attestation GUIDs). Authenticators with these AAGUIDs will be rejected. Mutually exclusive with aaguidAllowList.

  - `webauthn_api.rpOrigin` (string)
    Web origin that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `webauthn_api.rpOrigins` (array)
    Use rpWebOrigins or rpMobileOrigins instead

  - `google` (object)
    Google login configuration

  - `google.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `google.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `google.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `line` (object)
    Line login configuration

  - `apple` (object)
    Apple login configuration

  - `apple.clientId` (string, required)
    Services ID retrieved from Apple

  - `apple.clientSecret` (string)
    Client Secret Signing Key retrieved from Apple

  - `apple.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `apple.appleTeamId` (string, required)
    Apple Team ID

  - `apple.keyId` (string, required)
    Apple Key ID

  - `facebook` (object)
    Facebook login configuration

  - `push` (object)
    Push login configuration

  - `push.apn` (array)
    APN configuration. Can be a single object or an array of objects.

  - `push.apn.key` (string, required)
    APN key

  - `push.apn.keyId` (string, required)
    APN key id

  - `push.apn.teamId` (string, required)
    APN team id

  - `push.apn.bundle` (string, required)
    APN bundle

  - `push.apn.isProduction` (boolean)
    Is Production APN Environment

  - `push.fcm` (object)
    FCM configuration

  - `push.fcm.key` (object, required)
    FCM key

  - `tiktok` (object)
    Tiktok login configuration

## Response 200 fields (application/json):

  - `result` (object, required)

  - `result.auth_methods` (object, required)
    Login preferences

  - `result.auth_methods.google` (object)
    Google login configuration

  - `result.auth_methods.google.clientId` (string, required)
    Client ID retrieved from the identity provider

  - `result.auth_methods.google.clientSecret` (string)
    Client Secret retrieved from the identity provider

  - `result.auth_methods.google.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.auth_methods.facebook` (object)
    Facebook login configuration

  - `result.auth_methods.email` (object)
    Email magic link login configuration

  - `result.auth_methods.email.expiresIn` (number, required)
    Number of minutes until the email link/code expires

  - `result.auth_methods.email.linksPerUser` (number, required)
    Allowed magic links to send a user per minute

  - `result.auth_methods.email.message` (object, required)

  - `result.auth_methods.email.message.primaryColor` (string, required)
    Primary color of the email, specified as a Hex color

  - `result.auth_methods.email.message.from` (string)
    Origin of the email message

  - `result.auth_methods.email.message.subject` (string)
    Subject of the email message

  - `result.auth_methods.email_otp` (object)
    Email one time password login configuration

  - `result.auth_methods.email_otp.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.auth_methods.email_otp.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.email_otp.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.email_otp.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.auth_methods.email_otp.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.auth_methods.apple` (object)
    Apple login configuration

  - `result.auth_methods.apple.clientId` (string, required)
    Services ID retrieved from Apple

  - `result.auth_methods.apple.clientSecret` (string)
    Client Secret Signing Key retrieved from Apple

  - `result.auth_methods.apple.redirectUris` (array)
    List of URIs approved for redirects for your client
    Example: ["https://www.example.com/login"]

  - `result.auth_methods.apple.appleTeamId` (string, required)
    Apple Team ID

  - `result.auth_methods.apple.keyId` (string, required)
    Apple Key ID

  - `result.auth_methods.sms` (object)
    SMS one time password login configuration

  - `result.auth_methods.sms.expiresIn` (number, required)
    Number of minutes until the OTP expires

  - `result.auth_methods.sms.lockoutDuration` (number)
    OTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.sms.maxFailures` (number, required)
    Number of wrong OTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.sms.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.auth_methods.sms.crossClientsAllowed` (boolean)
    Determines if OTP authentication is allowed across different clients within the same application

  - `result.auth_methods.webauthn_api` (object)
    WebAuthn API configuration

  - `result.auth_methods.webauthn_api.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.webauthn_api.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.webauthn_api.lockoutTiers.attempts` (number, required)
    Number of failed attempts before this tier is triggered
    Example: 3

  - `result.auth_methods.webauthn_api.lockoutTiers.duration` (number, required)
    Lockout duration in minutes for this tier
    Example: 15

  - `result.auth_methods.webauthn_api.rpId` (string, required)
    Domain to which WebAuthn credentials are registered and used to authenticate (e.g., example.com)

  - `result.auth_methods.webauthn_api.rpWebOrigins` (array)
    A list of Web origins that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.auth_methods.webauthn_api.rpMobileOrigins` (array)
    A list of mobile origins that will be used to request registration and authentication. The origin must match the domain of the RP ID.

  - `result.auth_methods.webauthn_api.replaceExistingPasskey` (boolean)
    Set to true in order to replace the existing passkey. Default is False.

  - `result.auth_methods.webauthn_api.maxFailures` (number)
    Number of wrong attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.webauthn_api.lockoutDuration` (number)
    Lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.webauthn_api.allowSyncedPasskeys` (boolean)
    Allow synced passkeys

  - `result.auth_methods.webauthn_api.enforceAttestation` (boolean)
    Enforce attestation for device-bound passkeys

  - `result.auth_methods.webauthn_api.attestationType` (string)
    Attestation conveyance preference (none, indirect, or direct)
    Enum: "none", "indirect", "direct"

  - `result.auth_methods.webauthn_api.aaguidAllowList` (array)
    List of allowed AAGUIDs (Authenticator Attestation GUIDs). If specified, only authenticators with these AAGUIDs will be accepted. Mutually exclusive with aaguidBlockList.

  - `result.auth_methods.webauthn_api.aaguidBlockList` (array)
    List of blocked AAGUIDs (Authenticator Attestation GUIDs). Authenticators with these AAGUIDs will be rejected. Mutually exclusive with aaguidAllowList.

  - `result.auth_methods.webauthn_api.rpOrigin` (string)
    Web origin that will be used to request registration and authentication. The origin must match the domain of the RP ID, but may be a subdomain of the RP ID (e.g., https://login.example.com ). The origin must also include the HTTPS scheme and port (if relevant).

  - `result.auth_methods.webauthn_api.rpOrigins` (array)
    Use rpWebOrigins or rpMobileOrigins instead

  - `result.auth_methods.line` (object)
    Line login configuration

  - `result.auth_methods.password` (object)
    Password login configuration

  - `result.auth_methods.password.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.password.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.password.resetValidityMinutes` (number, required)
    Number of minutes until reset password token/OTP expires.
    Example: 5

  - `result.auth_methods.password.passwordComplexity` (number, required)
    Password complexity. Must be between 1 and 5.
    Example: 5

  - `result.auth_methods.password.passwordMinLength` (number, required)
    Minimum required length of the password.
    Example: 14

  - `result.auth_methods.password.blockPreviousPasswords` (number, required)
    Number of most recent passwords to block the user from setting as their new password.
    Example: 0

  - `result.auth_methods.password.checkHibp` (boolean)
    Check password updates against HIBP.

  - `result.auth_methods.password.checkDictionary` (boolean)
    Check password updates against a predefined dictionary.

  - `result.auth_methods.password.passwordExpiresIn` (number, required)
    Number of days until the password expires. Must be between 1 and 1096 days (3 years).
    Example: 90

  - `result.auth_methods.password.ignoreExpiration` (boolean)
    Ignore password expiration. If true, the password will never expire.

  - `result.auth_methods.password.maxPasswordFailures` (number)
    Number of wrong password attempts allowed before the user is suspended. Must be between 1 and 20.
    Example: 5

  - `result.auth_methods.password.passwordSuspensionDuration` (number)
    Number of minutes to suspend the user from authenticating using password after the maximum number of allowed failed attempts is exceeded. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.password.tempPasswordValidityHours` (number)
    Number of hours until temporary passwords are considered expired. Must be between 1 and 8760 hours (1 year).
    Example: 24

  - `result.auth_methods.password.requireMFA` (boolean)
    Require multi-factor authentication for password reset flows.

  - `result.auth_methods.password.codeLength` (number)
    The length of the generated OTP code. Must be between 4 and 8.
    Example: 6

  - `result.auth_methods.password.notifyOnPasswordUpdate` (boolean)
    Send email to end-user upon password update

  - `result.auth_methods.totp` (object)
    TOTP login configuration

  - `result.auth_methods.totp.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.totp.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.totp.algorithm` (string)
    The algorithm used to generate the TOTP code
    Enum: "sha1", "sha256", "sha512"

  - `result.auth_methods.totp.digits` (number)
    Number of digits in the generated TOTP code, must be 6 or 8
    Example: 6

  - `result.auth_methods.totp.period` (number)
    Number of seconds in which the TOTP code is valid
    Example: 30

  - `result.auth_methods.totp.window` (number)
    Number of windows to check for valid TOTP codes
    Example: 2

  - `result.auth_methods.totp.issuer` (string)
    TOTP issuer
    Example: My Company

  - `result.auth_methods.totp.maxFailures` (number)
    Number of wrong TOTP attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.totp.lockoutDuration` (number)
    TOTP lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.totp.maxTotpPerUser` (number)
    Maximum number of TOTP authenticators allowed per user. Must be between 1 and 50.
    Example: 1

  - `result.auth_methods.push` (object)
    Push configuration

  - `result.auth_methods.push.apn` (array)
    APN configuration. Can be a single object or an array of objects.

  - `result.auth_methods.push.apn.key` (string, required)
    APN key

  - `result.auth_methods.push.apn.keyId` (string, required)
    APN key id

  - `result.auth_methods.push.apn.teamId` (string, required)
    APN team id

  - `result.auth_methods.push.apn.bundle` (string, required)
    APN bundle

  - `result.auth_methods.push.apn.isProduction` (boolean)
    Is Production APN Environment

  - `result.auth_methods.push.fcm` (object)
    FCM configuration

  - `result.auth_methods.push.fcm.key` (object, required)
    FCM key

  - `result.auth_methods.tiktok` (object)
    TikTok login configuration

  - `result.auth_methods.pin_authenticator` (object)
    PIN authenticator configuration

  - `result.auth_methods.pin_authenticator.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.pin_authenticator.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.pin_authenticator.maxFailures` (number)
    Number of wrong PIN Authenticator attempts allowed before the passcode is invalidated. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.pin_authenticator.lockoutDuration` (number)
    PIN Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.face` (object)
    Face authenticator configuration

  - `result.auth_methods.face.failuresExpireIn` (number)
    Number of minutes until previous failed attempts are considered expired. Must be between 1 and 525600 minutes (1 year).
    Example: 15

  - `result.auth_methods.face.lockoutTiers` (array)
    Progressive lockout tiers based on failed attempts

  - `result.auth_methods.face.maxFailures` (number)
    Number of wrong Face Authenticator attempts allowed. Must be between 1 and 20.
    Example: 3

  - `result.auth_methods.face.lockoutDuration` (number)
    Face Authenticator lockout duration (in minutes) after maximum attempts are reached
    Example: 15

  - `result.auth_methods.face.saveImageEmbedding` (boolean)
    Enables saving the image embedding

## Response 400 fields (application/json):

  - `message` (array, required)
    Example: Bad request

  - `error_code` (number, required)
    Example: 400

## Response 404 fields (application/json):

  - `message` (string, required)

  - `error_code` (number, required)
    Example: 404