> ## Content Index
> Fetch the complete content index at: https://blog.fabrixly.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to Use Password-Only Authentication in Fabrixly-IDS
- URL: https://blog.fabrixly.com/how-to-use-password-only-authentication-3/
- Published: 2026-07-07T14:10:51.000Z
- Updated: 2026-07-07T14:38:51.000Z
- Author: Fabrixly
- Tags: Documentation

## Overview

Password-only authentication is the traditional login method using email (or mobile number) and password. It's simple and familiar to most users.

## Configuration

### Step 1: Set Up Fabrixly-IDS Client

Configure your OIDC client in the Admin Console or via API:

**Admin Console**:

1. Go to **Clients** → select your client → **Edit**
2. Under **Authentication Settings**:
  - Set **Auth Mode** to `Password Only`
  - Toggle **Enable Mobile Login** as needed
  - Set **OTP Delivery Method** (not used for password-only, but still set)
3. Save

**API Request**:

```bash
curl -X POST https://ids.fabrixly.com/api/clients \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer <your-admin-jwt-token>" \
  -d '{
    "client_name": "Password Only App",
    "redirect_uris": ["http://localhost:3002/callback"],
    "response_types": ["code"],
    "grant_types": ["authorization_code", "refresh_token"],
    "token_endpoint_auth_method": "client_secret_basic",
    "auth_mode": "password",
    "enable_mobile_login": false,
    "otp_delivery_method": "email",
    "requires_consent": false
  }'

```

## User Experience Flow

1. User visits your app's login page
2. App redirects to Fabrixly-IDS login screen with email/mobile and password fields
3. User enters credentials and clicks "Sign In"
4. Fabrixly-IDS validates password
5. User is redirected back to your app with auth code
6. App exchanges code for tokens
7. User is logged in!

## Example: Node.js Express App

Create `password-only-app.js`:

```javascript
const express = require('express');
const session = require('express-session');
const { Issuer, generators } = require('openid-client');

const app = express();
const PORT = 3002;

app.use(session({
  secret: 'secure-session-secret',
  resave: false,
  saveUninitialized: true
}));

async function init() {
  const issuer = await Issuer.discover('https://ids.fabrixly.com/oidc');
  return new issuer.Client({
    client_id: 'your-client-id',
    client_secret: 'your-client-secret',
    redirect_uris: ['http://localhost:3002/callback']
  });
}

let client;
init().then(c => client = c);

// Login route
app.get('/login', (req, res) => {
  req.session.state = generators.state();
  req.session.nonce = generators.nonce();
  
  const authUrl = client.authorizationUrl({
    scope: 'openid profile email',
    state: req.session.state,
    nonce: req.session.nonce
  });
  res.redirect(authUrl);
});

// Callback
app.get('/callback', async (req, res) => {
  const params = client.callbackParams(req);
  const tokenSet = await client.callback(
    'http://localhost:3002/callback',
    params,
    { state: req.session.state, nonce: req.session.nonce }
  );
  
  req.session.tokenSet = tokenSet;
  req.session.user = await client.userinfo(tokenSet.access_token);
  res.redirect('/dashboard');
});

// Dashboard
app.get('/dashboard', (req, res) => {
  if (!req.session.user) return res.redirect('/login');
  
  res.send(`
    <h1>Password-Only Login Demo</h1>
    <p>Welcome, ${req.session.user.email}!</p>
    <a href="/logout">Logout</a>
  `);
});

app.listen(PORT, () => console.log(`App on http://localhost:${PORT}`));

```

## Security Considerations

1. Always use HTTPS to protect passwords in transit
2. Fabrixly-IDS stores passwords hashed with bcrypt, no plaintext
3. Use strong password policies (minimum length, complexity)
4. Enable account locking after failed attempts
5. Encourage users to use unique, strong passwords

## Troubleshooting

- **"Invalid password" error**: Check user credentials, ensure password is correct
- **Login form doesn't show password field**: Verify `auth_mode` is set to "password" in client config
- **User can't log in with mobile number**: Ensure `enable_mobile_login` is true and user has a verified mobile number

## Next Steps

- Try the 2FA mode for higher security
- Implement forgot password flow
- Add password complexity requirements