---
title: "Set Up Email-Based Authentication"
slug: "set-up-email-based-authentication"
updated: 2026-06-09T05:06:39Z
published: 2026-06-09T05:06:39Z
canonical: "support.whatfix.com/set-up-email-based-authentication"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.whatfix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Set Up Email-Based Authentication

> [!WARNING]
> Note:
> 
> - Email-Based Authentication is a Beta feature. To enable this feature, contact your Customer Success Manager.
> - Whatfix Mirror supports end-user authentication through Single Sign-on (SSO), Email-Based Authentication, or both, based on your requirements. When both are enabled, learners can be authenticated through either method. For more information, see [Set Up Single Sign-On](/mirror/docs/set-up-single-sign-on) and [Set Up End-User Authentication](/mirror/docs/set-up-end-user-authentication).

### Overview

Email-Based Authentication is an alternative end-user authentication mechanism in Whatfix Mirror that restricts access to [shared Mirror Screens](/mirror/docs/share-whatfix-mirror) using email-based one-time password (OTP) verification. Only learners whose email domains have been approved can access the shared Mirror simulation.

With Email-Based Authentication, you can define approved email domains from the Mirror Dashboard. Learners accessing a shared Mirror simulation must verify their email using an OTP before gaining access. This ensures that only authenticated learners can access the Mirror simulation.

[Email-Based Authentication in Mirror](https://player.vimeo.com/video/1188825940?badge=0&autopause=0&player_id=0&app_id=58479&quality=1080p)

### How Email-Based Authentication works

Once you configure one or more approved email domains in the Mirror Dashboard, learners can begin accessing shared Mirror simulations through OTP-based authentication.

When a learner opens a Mirror simulation, they must enter their email address and complete a captcha. If the email domain matches the configured whitelist, Whatfix sends an OTP to the learner's email address. The OTP remains valid for 10 minutes. If the learner does not receive the OTP, a resend option becomes available 30 seconds after the initial OTP was triggered. Whatfix grants access only after the learner enters the correct OTP.

Once authenticated, learners can access all Mirror Screens within the same browser session without re-authenticating for each Workflow or Simulation. An authenticated session remains valid for 7 days, after which learners must re-authenticate to regain access.

> [!WARNING]
> Note:
> 
> Incognito browser sessions are not supported for persistent access.

### When should you use Email-Based Authentication?

Use Email-Based Authentication if:

- Your learners are external users, partners, or third-party users.
- You want to restrict access to shared Mirror simulations.
- You need an authentication mechanism without onboarding learners into your Identity Provider (IdP).

For more information, see [Manage Approved Domains](/mirror/docs/manage-approved-domains).

The feature release stage in which functionality is made available to a limited group of users for testing and feedback. Beta features are generally stable but may still undergo changes before becoming Generally Available (GA).

Your Customer Success Manager (CSM) is your direct contact for features involving specific customer agreements, such as using AI features.

Whatfix Mirror is an application simulation software that provides an immersive and interactive simulation of any web application.

Single Sign-on is a user authentication method that allows users to log in to multiple applications and websites with one set of credentials.

A sequence of captured mirror screens representing a specific user journey or process (e.g., "How to create a Lead in Salesforce?").

A feature that enables you to connect and link multiple Mirror Workflows to represent a complex user journey across an application or ecosystem. Workflows added to a simulation are automatically linked.

An Identity Provider (IdP) is an authority system that holds and verifies the user authentication information. Whatfix interacts with your IdP and trusts the information provided by the IdP to gain access to the application. Whatfix supports the following identity providers: Okta, Azure Active Directory, or any identity provider compliant with SAML 2.0 that works with Whatfix SSO.