Build mid-flow forms for sign-in and sign-up
Design step-based forms in the console, attach them to authentication hooks, and review submissions without a custom hosted page.
From the changelog: Visual form builder for authentication flows
Authdog Team
Collecting extra fields during sign-up or after MFA usually means a custom page and a fragile resume back into the auth flow. Authdog now has a visual Forms builder: design the steps in the console, attach the form to a flow hook, and the hosted UI renders it mid-flow.
This is the longer note behind the August 25 changelog entry.
What you can build
A form is a definition JSON the identity service already consumed (formFlow). The builder edits that contract:
- Steps with a title, fields, and a pointer to the next step
- Field types: text, email, phone, number, boolean, date, URL, password, dropdown, choice, and a legal checkbox
- Validation: required, min/max length, options for choice fields
- File attachments on the console editor
- Hook attachment:
pre_registration,pre_authentication,post_authentication,pre_token_issuance
Published forms are what the hosted flow can render. Drafts stay in the console until you publish. Submissions are stored and visible for review; management and public APIs expose definitions and responses.
When the user completes the form, the identity service resumes the flow at the hook that paused it. You do not hand-build the return URL.
Set it up
- Open Forms in the console and create a form.
- Add steps and fields. Keep required legal checkboxes on their own step if you need an explicit accept.
- Publish the form.
- Attach it to a hook on the authentication flow you want to pause (sign-up vs sign-in vs token issuance are different moments).
- Run the hosted flow and confirm the form appears, then check submissions.
A form attached to pre_token_issuance runs after authentication and before tokens go out. Use that for claims you need on the token, not for the password itself.
Trust boundaries
Form data is application data you asked for. Treat passwords and legal accepts as sensitive. Attachments follow the same environment storage rules as other branding and upload assets.
A completed form does not authenticate the user. Hooks run in the existing auth pipeline; bot protection and risk checks still apply to the surrounding sign-in or sign-up request.
Try it
Open Forms, publish a one-step form, and attach it to pre_registration. The original release note is in the changelog.