Click any flow from the Flows list. The builder opens. It's a visual editor with a slot per trigger point.
The layout
The flow is a top-down sequence of slots. The login flow looks like:
┌─────────────────────────────────────┐
│ pre-credential-check [+ Add] │
│ • domain-allowlist ⚙ ✕ │
│ • rate-limit-by-ip ⚙ ✕ │
├─────────────────────────────────────┤
│ ▼ (platform: credentials checked) │
├─────────────────────────────────────┤
│ post-credential-check [+ Add] │
│ (no actions) │
├─────────────────────────────────────┤
│ ▼ (platform: MFA if required) │
│ ▼ (platform: session minted) │
├─────────────────────────────────────┤
│ post-success [+ Add] │
│ • slack-on-admin-signin ⚙ ✕ │
│ • crm-sync ⚙ ✕ │
└─────────────────────────────────────┘
The shaded rows (▼ platform: ...) are non-editable platform steps. The numbered slots are yours.
Adding an Action
Click + Add on a slot. A panel slides open showing:
Your custom Actions — uploaded TS / JS Actions (see Create an action).
Platform-shipped templates — pre-built Actions for common needs (rate-limit-by-IP, domain allowlist, CRM sync, etc.).
Drag the Action into the slot. Click ⚙ to configure (each Action exposes its own config fields). Save.
Reordering Actions within a slot
Drag the Action up or down within its slot. Actions run in the order shown. Save.
A common ordering rule: cheap-and-blocking Actions first (rate-limit, allowlist), then expensive Actions (external API calls, decorations). If the cheap Action blocks, the expensive one never runs.
Configuring an Action
Each Action declares its own config schema. The configure modal shows the form. Common knobs:
Allowed domains — for the domain-allowlist Action, the list of permitted email domains.
Rate limit — for rate-limit Actions, the requests-per-minute threshold.
Webhook URL — for Slack / CRM Actions, where to post.
Claim name + value template — for decoration Actions, what to add to the token.
The schema is per-Action and defined by whoever authored the Action. Look at the Action's description for what each field controls.
Test a flow
The builder has a Test run button (top right). Click to simulate a sign-in attempt through this flow.
You supply:
User email — pick from existing users or type one for hypothetical scenarios.
Request context — IP, user agent (for testing Actions that depend on these).
The platform runs the flow as if a real sign-in had been initiated; you see each Action's input, output, and outcome. No real session is minted — it's purely diagnostic.
Use this before saving to confirm your new Action's logic is right.
Save + propagate
Save the flow. Changes apply immediately to the NEXT sign-in attempt against any application using this flow. Existing sessions are unaffected.
Each save records an audit-log entry with before/after state of the flow's Actions.
Disable an Action without removing it
Click the Action's ⚙ → toggle Enabled off. The Action stays in the slot but is skipped on flow runs. Useful for temporarily disabling a flaky Action during incident response without losing its configuration.
Bypass for testing
In a development tenant, you may want to temporarily skip all Actions to test the platform's default behaviour. The flow's menu has Disable all actions in this flow — useful for "what does the system flow look like without my customisation?"
Common patterns
Domain-restrict pattern
Slot: pre-credential-check. Action: domain-allowlist. Config: list of permitted domains. Effect: only allows sign-ins from emails in the list.
Risk-based step-up pattern
Slot: post-credential-check. Action: risk-score-step-up. Config: AAL threshold + risk score threshold. Effect: if the risk engine scores the sign-in above threshold, demand MFA even if not normally required.
Custom-claim decoration
Slot: post-success. Action: decorate-token. Config: claim name + value source (e.g., from user.custom_attributes.tier). Effect: adds the claim to every issued access token.
CRM sync on signup
Slot: post-success of the registration flow. Action: webhook-emit. Config: URL + secret of your CRM webhook receiver. Effect: every successful signup notifies your CRM.