---
title: Internal Authentication Flow
---

This flow is executed if the user logs in using the login UI hosted by ZITADEL.

The flow is represented by the following Ids in the API: `3`

## Post Authentication

A user has authenticated directly at ZITADEL.
ZITADEL validated the users inputs for password, OTP or passkey.
Each validation step triggers the action.

The trigger is represented by the following Ids in the API: `TRIGGER_TYPE_POST_AUTHENTICATION` or `1`.

### Parameters of Post Authentication Action

- `ctx`
  The first parameter contains the following fields
    - `v1`
        - `authMethod` *string*
          This is one of "password", "OTP", "U2F" or "passwordless"
        - `authError` *string*
          This is a verification errors string representation. If the verification succeeds, this is "none"
        - `authRequest` [*auth request*](/apis/actions/objects#auth-request)
        - `httpRequest` [*http request*](/apis/actions/objects#http-request)
- `api`
  The second parameter contains the following fields
    - `metadata`
      Array of [*metadata*](./objects#metadata-with-value-as-bytes). This function is deprecated, please use `api.v1.user.appendMetadata`
    - `v1`
        - `user`
            - `appendMetadata(string, Any)`
              The first parameter represents the key and the second a value which will be stored

## Pre Creation

A user registers directly at ZITADEL.
ZITADEL did not create the user yet.

The trigger is represented by the following Ids in the API: `TRIGGER_TYPE_PRE_CREATION` or `2`.

### Parameters of Pre Creation

- `ctx`
  The first parameter contains the following fields
    - `v1`
        - `user` [*human*](./objects#human-user)
        - `authRequest` [*auth request*](/apis/actions/objects#auth-request)
        - `httpRequest` [*http request*](/apis/actions/objects#http-request)
- `api`
  The second parameter contains the following fields
    - `metadata`
      Array of [*metadata*](./objects#metadata-with-value-as-bytes). This function is deprecated, please use `api.v1.user.appendMetadata`
    - `setFirstName(string)`
      Sets the first name
    - `setLastName(string)`
      Sets the last name
    - `setNickName(string)`
      Sets the nickname
    - `setDisplayName(string)`
      Sets the display name
    - `setPreferredLanguage(string)`
      Sets the preferred language, the string has to be a valid language tag as defined in [RFC 5646](https://www.rfc-editor.org/rfc/rfc5646)
    - `setGender(int)`
      Sets the gender.
      <ul><li>0: unspecified</li><li>1: female</li><li>2: male</li><li>3: diverse</li></ul>
    - `setUsername(string)`
      Sets the username
    - `setEmail(string)`
      Sets the email
    - `setEmailVerified(bool)`
      If true the email set is verified without user interaction
    - `setPhone(string)`
      Sets the phone number
    - `setPhoneVerified(bool)`
      If true the phone number set is verified without user interaction
    - `v1`
        - `user`
            - `appendMetadata(string, Any)`
              The first parameter represents the key and the second a value which will be stored

## Post Creation

A user registers directly at ZITADEL.
ZITADEL successfully created the user.

The trigger is represented by the following Ids in the API: `TRIGGER_TYPE_POST_CREATION` or `3`.

### Parameters of Post Creation

- `ctx`
  The first parameter contains the following fields
    - `v1`
        - `getUser()` [*user*](./objects#user)
        - `authRequest` [*auth request*](/apis/actions/objects#auth-request)
        - `httpRequest` [*http request*](/apis/actions/objects#http-request)
- `api`
  The second parameter contains the following fields
    - `userGrants` Array of [*userGrant*](./objects#user-grant)'s
    - `v1`
        - `appendUserGrant(`[`userGrant`](./objects#user-grant)`)`