Kinde · Const

Pre-registration workflow

Kinde’s user:pre_registration workflow runs after single-factor authentication and before a user record is created. Use it to validate registration inputs or block risky sign-ups.

How it works

A pre-registration workflow runs after single-factor authentication but before Kinde creates the user record. It receives the workflow event and can inspect registration data, then use the authentication binding to deny access when validation or business rules fail.

Syntax

Trigger: `user:pre_registration`

Key points

The trigger executes only after the user completes a single authentication factor.
It provides a gate before Kinde persists the new user account.
Your workflow function receives Kinde's event object as its main input.
The event is organized around request data and contextual workflow information.
Use it to reject registrations originating from suspicious IP addresses.
Use it to reduce spam by refusing disposable email domains.

Common mistakes

Do not treat this trigger as proof that the user is fully authorized: organization access and MFA have not yet been evaluated.

Example: Block disposable email registrations

import { denyAccess } from "kinde-workflows";

export default async function workflow(event) {
  const email = event.request.user.email;
  const disposable = ["mailinator.com", "tempmail.com"];

  if (disposable.some((domain) => email.endsWith(`@${domain}`))) {
    denyAccess("Disposable email addresses are not allowed");
  }

  return event;
}

Rejects registrations when the submitted email belongs to a known disposable-email domain.

When to use it

Block suspicious IP addresses

Registration security

Reject disposable email domains

Spam prevention

Apply pre-account registration rules

Business validation

Interview questions

QWhen does the pre-registration workflow run?

It fires on the user:pre_registration trigger after single-factor authentication and before a Kinde user record exists. This makes it suitable for validating registration data before account creation.

Follow-up: What authorization checks have happened at this point? Organization access and MFA have not been checked, so later workflow stages or the normal authentication flow must still handle them.

QWhat does the workflow event contain?

The workflow receives an event object with request and context keys. These provide the trigger reason and additional data that the workflow can use when deciding whether registration should proceed.

Follow-up: How would you inspect a submitted email? Read the relevant value from the request data, then apply a validation rule before allowing the registration to continue.

QWhat are practical uses for this workflow?

A common use is blocking registrations from suspicious IP addresses or refusing disposable email addresses. The workflow can apply these rules before Kinde creates the user record.

Follow-up: How could a product use this for fraud prevention? It could call an external fraud or reputation service and deny access when the returned risk assessment exceeds the product's threshold.

user:post_authentication
user:pre_mfa
kinde.auth
denyAccess

Source: User pre-registration workflow. Checked 2026-10-15.