# v2.1 — Auth & Access

Harden authentication with social login and OIDC. Give admins control over who can register.

## Major Features

### Authentication Enhancements
- Social login (Google, GitHub, Discord, etc.)
- **OIDC support** — connect any enterprise identity provider (Keycloak, Okta, Azure AD, Authing, etc.)
- Login by username in addition to email
- Email configuration (SMTP for password reset and notifications)

### Registration Controls
- Admin configurable: open registration / invite-code only / closed
- Invite code system: generate single-use codes, track who used each code
- Admin can generate invite codes in bulk

## User Scenarios

**Company with SSO:**
> Our team uses Okta. The admin configures OIDC in ZPan with our Okta discovery URL. Now everyone logs in with their company credentials.

**Private instance:**
> I run ZPan for my friends. I set registration to invite-only, generate 10 codes, and hand them out. Each code works once.

## v1 Issues Resolved

- **#173** OIDC login
- **#121** Registration gate
- **#120** Invite code system
- **#221** Login by nickname