kinde-oss · tamalchowdhury · Jul 30, 2026 · coderabbitai · Jul 30, 2026 · coderabbitai
@@ -1,9 +1,7 @@
 ---
 page_id: c93d0dc2-adad-4bb3-9618-6dc2109d5aa8
 title: Top questions about Kinde authentication
-description: >-
-  A collection of the top questions and answers about how to set up and
-  configure Kinde authentication for your user's needs.
+description: "Get clear answers on Kinde auth setup—methods, social and SSO, MFA, iframes and popups, sessions, tokens, and troubleshooting"
 sidebar:
   order: 4
 relatedArticles:
@@ -12,32 +10,26 @@ relatedArticles:
   - 43e8aa2d-76a4-4445-ae90-84d3f1a55fcb
 featured: false
 deprecated: false
-ai_summary: >
-  A collection of the top questions and answers about how to set up and
-  configure Kinde authentication for your user's needs.
 topics:
-  - authentication
-  - enterprise auth
-  - SSO
-  - social sign-in
-  - authentication issues
-  - user access control
-  - user access
-  - user authentication
+  - authenticate
+  - about-auth
+sdk: []
+languages: []
 audience:
-  - frontend-developer
+  - developer
+  - product-manager
 complexity: beginner
 keywords:
-  - login
-  - sign in
+  - authentication FAQ
   - popup
-  - error
-  - sessions
-  - tokens
-  - auth
-  - forgot password
+  - iframe
+  - MFA
+  - SAML
+  - social sign-in
   - password reset
-updated: 2026-03-26
+  - sessions
+updated: 2026-07-30
+ai_summary: "FAQ covering common Kinde authentication questions for developers and product teams. Explains how to choose auth methods, password versus passwordless, account linking, per-app and organization requirements, multi-domain sessions, and why hosted auth pages cannot be embedded in a modal or iframe while framed apps can authenticate via React and JavaScript SDK popups. Covers social sign-in, enterprise SAML and Entra ID, MFA, username auth, device authorization, custom pages, developer integration questions, troubleshooting for codes and sessions, security best practices, and advanced custom authentication. Links out to detailed setup guides throughout. Intended for frontend developers and product managers configuring or troubleshooting Kinde auth."
 ---
 
 Here are concise answers to common authentication questions. Select a question to expand the answer.
@@ -96,7 +88,15 @@ Use multi-domain authentication to maintain sign-in sessions across domains and
 <details>
 <summary><strong>Can I embed Kinde authentication inside a modal or iframe in my application?</strong></summary>
 
-No. Kinde uses redirect-based OAuth 2.0 flows rather than inline embeddable authentication. Users are redirected to Kinde (or your custom domain) to sign in and then redirected back to your app. Embedding the auth flow in a modal or iframe is not supported.
+Kinde's hosted authentication pages cannot be embedded in an iframe or an in-page modal. Kinde uses redirect-based OAuth 2.0 flows, and the hosted pages send strict CSP and security headers that prevent them from being framed. This is deliberate — it protects your users from clickjacking and credential theft.
+
+If **your application** runs inside an iframe, that is supported. The React and JavaScript SDKs detect that they are framed and open Kinde in a popup window rather than redirecting the framed page. The user authenticates in a genuine top-level window, and the SDK returns the result to your app automatically.
+
+- [React SDK — Authentication in a popup window](/developer-tools/sdks/frontend/react-sdk/#authentication-in-a-popup-window)
+- [JavaScript SDK — Authentication in a popup window](/developer-tools/sdks/frontend/javascript-sdk/#authentication-in-a-popup-window)
+
+If you want authentication to feel native to your app, build [custom sign-up and sign-in pages](/authenticate/custom-configurations/custom-authentication-pages/) instead. You control the styling and layout, while Kinde continues to host the security-critical steps such as password entry, code verification, and MFA.
+
 [Set callback and redirect URLs](/get-started/connect/callback-urls/)
 </details>
 

@@ -1,7 +1,7 @@
 ---
 page_id: 08415f77-cd58-498d-b3b2-d1cdda162153
 title: JavaScript SDK
-description: "Complete guide for the Kinde JavaScript (PKCE) SDK covering setup, authentication, getAccessToken() for API calls, invitations, the self-serve portal, background token refresh, organizations, permissions, feature flags, and API references."
+description: "Authenticate SPAs with the Kinde JavaScript PKCE SDK—login, iframe popup auth, tokens, refresh, orgs, permissions, and flags"
 sidebar:
   order: 3
 tableOfContents:
@@ -26,21 +26,16 @@ complexity: intermediate
 keywords:
   - JavaScript SDK
   - PKCE
-  - authentication
-  - login
-  - register
-  - logout
-  - organizations
-  - access tokens
+  - createKindeClient
   - getAccessToken
+  - popup authentication
+  - iframe
   - refresh tokens
-  - JWT
-  - portal
-  - invitations
-updated: 2026-07-14
+  - organizations
+updated: 2026-07-30
 featured: false
 deprecated: false
-ai_summary: Complete guide for the Kinde JavaScript (PKCE) SDK for single-page apps, covering setup with the starter kit or an existing project, createKindeClient configuration, login/register/logout flows, invitations, the self-serve portal, user profile helpers, and calling your API with getAccessToken() (getToken() is deprecated). Explains background access-token refresh on init, pre-expiry timers, tab focus, and multi-tab sync; session persistence via custom domains or is_dangerously_use_local_storage for local dev; organizations, permissions, feature flags, audience and scope; FAQs; and full createKindeClient and kindeClient API references.
+ai_summary: "Guide to the Kinde JavaScript PKCE SDK for single-page apps. Covers setup with the starter kit or an existing project, createKindeClient configuration, login, register, logout, invitations, and the self-serve portal. Documents automatic popup authentication when the app runs inside an iframe, including same-origin redirect_uri requirements and user-gesture guidance. Explains user profile helpers, calling your API with getAccessToken, background access-token refresh on init, pre-expiry timers, tab focus, and multi-tab sync, plus session persistence via custom domains or local storage for local development. Also covers organizations, permissions, feature flags, audience and scope, FAQs, and full createKindeClient and kindeClient API references. Intended for frontend developers building JavaScript SPAs with Kinde."
 ---
 
 Kinde JavaScript SDK for single-page JavaScript apps.
@@ -228,6 +223,24 @@ You can also pass options to sign the user out of every session, or override the
     });
     ```
 
+### Authentication in a popup window
+
+If your app runs inside an iframe — an embedded dashboard, a marketplace app, or a partner integration — the SDK opens Kinde in a popup window instead of redirecting the framed page. This is automatic. You call `login()`, `register()` and `logout()` exactly as you would otherwise.
+
+When the user finishes authenticating, Kinde redirects the popup to your `redirect_uri`. The SDK on that page posts the result back to the window that opened it and closes the popup, then your `on_redirect_callback` fires in your app as usual.
+
+Kinde's hosted authentication pages cannot be embedded in an iframe themselves — they send security headers that prevent framing. The popup is what lets a framed app authenticate without weakening those protections.
+
+<Aside type="warning">
+
+Your `redirect_uri` must be on the **same origin** as the app that opened the popup, and it must load the page where you call `createKindeClient`. The SDK checks the opener's origin before posting the result. If the origins don't match, the popup finishes authenticating but your app never receives the result.
+
+</Aside>
+
+The popup opens at 500 × 600 pixels, centred on the user's screen. This is not configurable in this SDK. If you need to control the popup dimensions, use the [React SDK](/developer-tools/sdks/frontend/react-sdk/#set-the-popup-size-and-position), which exposes a `popupOptions` option.
+
+Browsers block popups that aren't opened in response to a user gesture, so call `login()` or `register()` directly from a click handler. When a popup can't be opened during sign-out, the SDK calls `on_error_callback` with the error `ERR_POPUP`.
+
 ### Self-serve portal
 
 Authenticated users can open the Kinde [self-serve portal](/build/self-service-portal/self-serve-portal-for-users/) with `portal()`. The client redirects them to a one-time portal URL.
@@ -677,6 +690,8 @@ Type: `string` (required)
 
 The URL that the user will be returned to after authentication. This must match an allowed callback URL for the application in Kinde.
 
+For popup authentication (when your app runs inside an iframe), this URL must be on the same origin as your app and must load the page where you call `createKindeClient`. See [Authentication in a popup window](#authentication-in-a-popup-window).
+
 Type: `string` (required)
 
 ### `audience`

@@ -1,7 +1,7 @@
 ---
 page_id: f74a81d3-3588-4fd4-a0ba-13eba550eff1
 title: React SDK
-description: "Complete guide for React SDK including installation, provider setup, authentication hooks, callback handling, and API integration for React 18+ applications."
+description: "Integrate Kinde auth in React 18+ with providers, hooks, iframe popup login, tokens, orgs, permissions, and feature flags"
 sidebar:
   order: 4
 head:
@@ -25,17 +25,17 @@ audience: developers
 complexity: intermediate
 keywords:
   - React SDK
-  - React Context Provider
-  - useKindeAuth hook
-  - authentication
-  - login
-  - register
-  - logout
+  - useKindeAuth
+  - KindeProvider
+  - popup authentication
+  - iframe
   - access tokens
-updated: 2026-04-14
+  - organizations
+  - feature flags
+updated: 2026-07-30
 featured: false
 deprecated: false
-ai_summary: Complete guide for React SDK including installation, provider setup, authentication hooks, callback handling, and API integration for React 18+ applications.
+ai_summary: "Guide to integrating the Kinde React SDK (v5) with React 18+ applications. Covers installing the starter kit or wrapping an existing app with KindeProvider, sign-in and sign-up via hooks and link components, logout, and the self-serve portal. Documents popup authentication for apps running inside an iframe, including popupOptions, same-origin redirectUri requirements, blocked-popup handling, and local iframe testing. Also covers user profile, authentication state, advanced access control, calling APIs with access tokens, audience, organizations, permissions, feature flags, claims, token refresh behaviour, full KindeProvider and useKindeAuth API references, and migrating from v4 to v5. Intended for frontend developers building React apps with Kinde."
 ---
 
 The Kinde React SDK allows developers to quickly and securely integrate a new or existing React application to the Kinde platform.
@@ -259,6 +259,74 @@ const handlePortalClick = async () => {
 <button onClick={handlePortalClick} type="button">Manage account</button>
 ```
 
+## Authentication in a popup window
+
+If your app runs inside an iframe — for example, an app embedded in a partner platform, a marketplace listing, or a dashboard widget — the SDK opens Kinde in a popup window instead of redirecting the page. This happens automatically. You don't need to change how you call `login()`, `register()` or `logout()`.
+
+The SDK detects that it is framed and, instead of setting `document.location`, opens a popup at your Kinde domain. When the user finishes authenticating, Kinde redirects the popup to your `redirectUri`. The SDK code running on that page posts the result back to the window that opened it, then closes the popup. Your app receives the result through the same `onSuccess` callback it would have received on a full-page redirect.
+
+Kinde's hosted authentication pages cannot themselves be embedded in an iframe — they send security headers that prevent it. The popup is what makes authentication work for a framed app: the user authenticates in a genuine top-level browser window, so Kinde's protections stay intact.
+
+<Aside type="warning">
+
+Popup authentication only works if your `redirectUri` points to a route **on the same origin as your app** that renders inside `KindeProvider`. The SDK verifies the origin of the message before accepting the result, and the code that posts the result is part of the provider. If your `redirectUri` is on a different origin, or points at a page that doesn't mount `KindeProvider`, the popup will complete authentication but your app will never receive the result.
+
+</Aside>
+
+### Set the popup size and position
+
+Use the `popupOptions` prop on `KindeProvider` to control the popup window. All four values are optional.
+
+```jsx
+// App.jsx
+<KindeProvider
+  clientId="your_kinde_client_id"
+  domain="https://yourbusiness.kinde.com"
+  redirectUri="https://yourapp.com/callback"
+  popupOptions={{
+    width: 600,
+    height: 700,
+  }}
+>
+  <Routes />
+</KindeProvider>
+```
+
+The popup defaults to 500 × 600 pixels, centred on the user's screen. Set `left` and `top` to position it yourself.
+
+### Handle a blocked popup
+
+Browsers block `window.open` when it isn't triggered by a user gesture. Always call `login()` or `register()` directly from a click handler — calling them from a `useEffect`, a timer, or after an `await` inside an async handler is likely to be blocked.
+
+When a popup is blocked, the SDK calls your `onError` callback with the error code `ERR_POPUP`:
+
+```jsx
+// App.jsx
+<KindeProvider
+  callbacks={{
+    onError: (error) => {
+      if (error.error === "ERR_POPUP") {
+        // Show your own "allow popups to sign in" message
+        setShowPopupHelp(true);
+      }
+    },
+  }}
+>
+  <Routes />
+</KindeProvider>
+```
+
+### Test popup authentication
+
+Popup mode only activates when the app is framed, so it won't trigger during normal local development. To test it, load your app inside an iframe on the same origin:
+
+```html
+<!-- test-frame.html, served from the same origin as your app -->
+<iframe src="http://localhost:3000" width="100%" height="800"></iframe>
+```
+
+Then add both the app URL and the callback URL to **Allowed callback URLs** in Kinde. See [Set callback and redirect URLs](/get-started/connect/callback-urls/).
+
 ## Test sign-up
 
 Register your first user by signing up yourself. You’ll see your newly registered user on the **Users** page in Kinde.
@@ -1031,10 +1099,26 @@ Required: No
 
 Default: `false`
 
+### `popupOptions`
+
+Size and position of the popup window used for authentication when your app is running inside an iframe. Ignored when your app is not framed, because authentication then happens by redirecting the page. See [Authentication in a popup window](#authentication-in-a-popup-window).
+
+Type: `{ width?: number; height?: number; left?: number; top?: number }`
+
+Required: No
+
+Default: `{}` — the popup opens at 500 × 600 pixels, centred on the user's screen
+
+```jsx
+<KindeProvider popupOptions={{ width: 600, height: 700 }}>
+```
+
 ### **`redirectUri`**
 
 The URL that the user will be returned to after authentication.
 
+For popup authentication (when your app runs inside an iframe), this URL must be on the same origin as your app and must render inside `KindeProvider`. See [Authentication in a popup window](#authentication-in-a-popup-window).
+
 Type: `string`
 
 Required: Yes

@@ -6,10 +6,11 @@ sidebar:
 relatedArticles:
   - c53c9254-7bbb-4d58-b949-3ccdc3cd3dee
   - 162a0888-6b7f-439e-9ba2-7b2c491fc95b
-description: Comprehensive overview of Kinde's security practices including XSS protection, CSRF prevention, bot detection, password standards, and TLS enforcement.
+description: "See how Kinde protects auth with XSS and CSRF defenses, bot detection, clickjacking prevention, password hashing, TLS, and WAF"
 topics:
   - get-started
   - learn-about-kinde
+  - security
 sdk: []
 languages: []
 audience:
@@ -18,20 +19,18 @@ audience:
   - business owners
 complexity: intermediate
 keywords:
-  - security
-  - xss protection
-  - csrf protection
+  - product security
+  - clickjacking
+  - CSRF
+  - XSS
   - bot detection
   - credential stuffing
-  - clickjacking
-  - password security
-  - tls
-  - waf
-  - rate limiting
-updated: 2024-01-15
+  - password hashing
+  - WAF
+updated: 2026-07-30
 featured: false
 deprecated: false
-ai_summary: Comprehensive overview of Kinde's security practices including XSS protection, CSRF prevention, bot detection, password standards, and TLS enforcement.
+ai_summary: "Overview of Kinde product security practices for authentication and platform protection. Explains callback URL origin checks to help prevent XSS, bot detection including CAPTCHA and traffic analysis, credential stuffing defenses via WAF and account lockout, CSRF protections using the state parameter, and clickjacking prevention on hosted auth pages with CSP and framing headers. Notes that React and JavaScript SDKs open auth in a popup when the customer app is iframed so those protections stay intact. Also covers enforced password standards, bcrypt password hashing, rate limits and throttling for denial-of-service mitigation, device fingerprinting against session hijacking, TLS version and cipher requirements, XSS and CSP controls for third-party scripts, and WAF blocking of malicious traffic. Intended for developers, admins, and business owners evaluating Kinde security."
 ---
 
 Here’s some of the practices, standards, and methods we use to keep your data, and user’s data secure. 
@@ -58,10 +57,12 @@ Kinde protects against [CSRF](https://cheatsheetseries.owasp.org/cheatsheets/Cro
 
 ## Hosted auth pages prevent clickjacking
 
-To prevent [clickjacking](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html) attacks where a user’s personal information or credentials may be stolen by hidden iFrames, use Kinde’s hosted pages for authentication. Hosted pages have protections in place such as such as strict CSP and security headers to prevent itself from being embedded as an iFrame.
+To prevent [clickjacking](https://cheatsheetseries.owasp.org/cheatsheets/Clickjacking_Defense_Cheat_Sheet.html) attacks, where a user's personal information or credentials may be stolen by hidden iFrames, use Kinde's hosted pages for authentication. Hosted pages have protections in place such as strict CSP and security headers to prevent them from being embedded as an iFrame.
 
 Kinde controls and hosts the authentication pages, so the risk for protecting pages is assumed by Kinde rather than you.
 
+If your own application runs inside an iframe, our [React](/developer-tools/sdks/frontend/react-sdk/#authentication-in-a-popup-window) and [JavaScript](/developer-tools/sdks/frontend/javascript-sdk/#authentication-in-a-popup-window) SDKs open authentication in a popup window so the user authenticates in a top-level browser window. This keeps these protections intact.
+
 ## Enforced password standards
 
 Kinde provides a baseline password protection policy for any customer who wants to include password authentication in their product.