Accounts and identity playbook

An accounts playbook for any web app or SaaS where people sign up, sign in and work together. It covers the product side of accounts. That means how people join, prove who they are, get back in, share an organisation, and leave again.

The attacks on accounts live in the security testing playbook. It covers password storage, login guessing, session cookies, resets, tokens and single sign-on checks. This playbook links there instead of repeating them. The website playbook has the addresses password managers look for, and its accessibility chapter covers sign-in forms.

Start with Sign-in methods. Choosing a provider or a library decides how much of the rest you build yourself. Teams that sell to businesses should read Organisations and teams and Business sign-on and provisioning next.

Chapters

1. Sign-up

   Ask for little, prove the email address before trusting it, and compare names in one canonical form. Then sign-up stays short and accounts stay clean.

   • Required 4
   • Recommended 1

2. Sign-in methods

   Pick who runs sign-in, keep your own user IDs, and make passkeys the first choice. Email links and provider logins each need their own care.

   • Required 3
   • Recommended 3
   • Optional 1

3. Second factors and recovery

   Make second factors easy to set up and recovery hard to abuse. Recovery codes, two factors each and a slow, loud last resort keep owners in and attackers out.

   • Required 4
   • Recommended 2
   • Avoid 1

4. Sessions and security activity

   Show people where they are signed in, let them sign out anywhere, end sessions when access changes, and show each person their own security log.

   • Required 2
   • Recommended 3

5. Roles and permissions

   Name permissions in code, map roles to them in one place, and test every role against every action. Then access stays right as the product grows.

   • Required 5
   • Recommended 2

6. Organisations and teams

   Let organisations own the data, invite people safely, never leave a team without an owner, and cut access the moment someone leaves.

   • Required 4
   • Recommended 3

7. Support and staff access

   Give staff their own accounts and check callers before changing anything. Support sees a customer's view only with a reason, a time limit and a trail.

   • Required 3
   • Recommended 1

8. Profile and account lifecycle

   Change emails and names without losing anyone, let people export and delete their account themselves, and close unused accounts only after warnings.

   • Required 2
   • Recommended 3

9. Business sign-on and provisioning

   Let each business customer bring its own identity provider, add and remove users through SCIM, and act on the security signals it sends.

   • Required 1
   • Recommended 4
   • Optional 1

All 53 rules on one page