Authentication

Kenresoft CMS uses Better Auth for authentication. There is one identity system for CMS staff, website visitors and Commerce customers.

Core user (Better Auth)
   ├── CMS role (optional): owner, admin, editor, author, viewer
   ├── Website account (role: none)
   └── Commerce profile (optional)

• A normal website user has role none and cannot access the admin API.
• Only authorized server-side code assigns a CMS role. The client cannot set it.
• Sign-in requires a verified email address.
• Staff can enable two-factor authentication (TOTP with backup codes) on their Profile page.
• The Owner can generate single-use recovery codes. Password reset is available by email once email is configured.

Session cookies are set by the API. When a website on a different origin needs sessions, use the same-origin proxy.

Auth endpoints are listed in Astro authentication. Roles are described in Users & Roles.