> ## Documentation Index
> Fetch the complete documentation index at: https://docs.app.strix.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Login Methods

> Select the correct login method for a test user, and verify that Strix can sign in

export const ScarfPixel = () => <img referrerPolicy="no-referrer-when-downgrade" src="https://static.scarf.sh/a.png?x-pxid=831669b6-b4bd-42cb-8832-2122c03e1d5f" alt="" width="1" height="1" style={{
  position: "absolute",
  width: 0,
  height: 0,
  opacity: 0,
  pointerEvents: "none"
}} />;

<ScarfPixel />

A test user tells Strix how to sign in to your application. Sign in to the application yourself. Then select the method that the application asks you for.

## The four methods

<AccordionGroup>
  <Accordion title="Username & Password">
    The account signs in with a username (or email) and a password. There is no second factor.

    Start with this method. It needs the least configuration, and it is the fastest method to verify.

    Give Strix these items:

    1. The username or the email address of the account.
    2. The password of the account.
  </Accordion>

  <Accordion title="Authenticator App">
    The application asks for a code of 6 digits from an authenticator app, for example Google Authenticator, Authy, or 1Password. Some applications call this code a TOTP code.

    Give Strix these items:

    1. The username and the password of the account.
    2. The setup key of the account. The setup key is the Base32 secret behind the **Can't scan?** link on the enrollment page.

    Strix makes each code from the setup key. Thus Strix does not need your telephone.

    Strix cannot use a factor that asks a person to approve the login, for example Duo Push, Okta Verify push, or SMS.
  </Accordion>

  <Accordion title="Email Code">
    The application sends a numeric code to the email address of the account. Usually the application also asks for a password.

    Give Strix these items:

    1. A Strix inbox as the email address of the account.
    2. The password of the account, if the application asks for one.

    Strix must read the code. Thus Strix must be the owner of the mailbox.
  </Accordion>

  <Accordion title="Magic Link">
    The account has no password. The application sends a link (or a code) that signs you in.

    Give Strix one item: a Strix inbox as the email address of the account.

    This method has the same condition as Email Code. Strix must be the owner of the mailbox.
  </Accordion>
</AccordionGroup>

## An account with MFA needs a Strix inbox

Strix can only complete a second factor that it controls. Strix controls a setup key that you give it, and email that comes to a Strix inbox. Strix cannot read a code that goes to your telephone or to your own mailbox.

Do these steps for the Email Code method and for the Magic Link method:

1. Make a Strix inbox in the test-user dialog. As an alternative, use the [provision-inbox endpoint](/guides/test-users#provision-a-managed-inbox).
2. Make a new test account with the inbox address, or change the email address of an existing account to the inbox address.
3. Switch on email login for that account.

The inbox address is also the username of the account. Thus you give the address one time.

Strix removes an inbox that no scan used for 30 days. You can make a new inbox at any time.

## Login verification

Strix verifies the credentials when you save them. The verification is a short run, usually one or two minutes, in the same sandbox that a scan uses. Strix opens the login page, signs in, and reports if it got access to authenticated content.

The test user then shows one of two results: verified or failed. Thus you find a bad login before the scan, and not after it.

This table gives the usual failures and the correction for each failure:

| Result                                                     | Correction                                                                                              |
| ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| The username or the password is wrong                      | Give the credentials again. Make sure that the account does not use SSO only.                           |
| Strix did not find the login page                          | Set **Login URL** in the **Advanced** section to the correct sign-in page.                              |
| The login needs a second factor that Strix does not have   | Select **Authenticator App** and give the setup key, or move the account to a Strix inbox.              |
| Strix could not read the code                              | Make sure that the email address of the account is the Strix inbox address, and that email login is on. |
| The account is locked, or bot protection stopped the login | Unlock the account, or permit the scan traffic.                                                         |

You can start a scan after a failed verification. Strix first shows a warning, because the scan can possibly test no authenticated area.

To do a verification with the API, refer to [Verify a test user's login](/guides/test-users#verify-a-test-users-login).