Kinde · Const

Post-authentication workflow

The user:post_authentication workflow runs after single-factor authentication. Use it for post-login checks, user enrichment, organization assignment, and first-time-user handling before authorization continues.

How it works

This workflow runs after single-factor authentication and before the authorization flow completes. It receives an event containing request and context data, allowing you to perform checks, enrich users, assign organizations, or identify first-time Kinde users.

Syntax

Trigger: `user:post_authentication`

Key points

Use the user:post_authentication trigger to run custom logic immediately after the user passes single-factor authentication.
The trigger covers common sign-in methods such as email/password and Google after their single-factor step completes.
The handler's primary input is the Kinde workflow event object.
The event exposes request and context as its two top-level keys.
The workflow can distinguish a first-time Kinde user from an existing user in the application's own database.

Common mistakes

It runs after single-factor authentication, not necessarily after every authentication-related step.
Use this trigger for user enrichment before token creation, rather than modifying claims directly in the token-generation workflow.

Example: Inspect the workflow event

export default async function handler(event) {
  const { request, context } = event;
  return { ...context, firstTimeUser: request?.user?.isFirstTimeUser };
}

A workflow handler receives the event object and can use its request and context data to apply post-authentication logic.

When to use it

Minimize account sharing

Evaluate recent login activity and IP information to detect impossible travel or suspicious access.

Enrich user records

Set additional user properties before Kinde generates tokens.

Assign organizations

Add an invited user to relevant organizations before authorization proceeds.

Detect first-time users

Branch application behavior when Kinde has created a user for the first time.

Interview questions

QWhat trigger identifies the post-authentication workflow, and when does it run?

The trigger is user:post_authentication. It fires after a user completes single-factor authentication, such as with email and password or Google.

Follow-up: How would you modify token claims instead? Use the user token generation workflow and its accessToken or idToken bindings.

QWhat data does the workflow handler receive?

The workflow can inspect the event object, whose main argument has request and context keys. Those provide the trigger reason and additional relevant data points.

Follow-up: What should be inspected first when implementing a workflow? Start with the event shape and the fields exposed in request and context for the selected trigger.

QWhat are practical uses for this workflow?

Typical uses include checking suspicious or impossible travel, adding user properties before token generation, adding invited users to organizations, and determining whether the user is new to Kinde.

Follow-up: How can an application respond to a high-risk login? Perform the external risk check in the workflow and block access proactively when the risk is high.

user:pre_registration
user:new_password_provided
user:tokens_generation
kinde.accessToken
kinde.idToken

Source: User post-authentication workflow. Checked 2026-10-15.