Auth

Authentication controls who can sign in to Factory and access its server. New Factory projects use Mastra platform authentication by default. You can also use a Mastra auth provider that supports both Server and Studio authentication.

To change how users sign in, configure the auth option on MastraFactory in your Factory Server's src/mastra/index.ts.

Mastra platform

The generated server uses Mastra platform sign-in when no alternative provider is configured. Open Factory and sign in with your Mastra account.

Configure credential encryption before users save model or integration credentials.

Other auth providers

Factory works with Mastra auth providers that support both Server and Studio authentication. Follow your provider's setup instructions, then pass the configured instance to the auth option on MastraFactory in src/mastra/index.ts. For example, using WorkOS with your existing storage:

src/mastra/index.ts

import { MastraAuthWorkos } from '@mastra/auth-workos'
import { MastraFactory } from '@mastra/factory'

const factory = new MastraFactory({
	storage,
	auth: new MastraAuthWorkos({ fetchMemberships: true }),
	// Keep your other Factory options.
})

The generated server already includes WorkOS configuration as an alternative to the default Mastra platform sign-in. Follow the WorkOS setup instructions to configure or customize it.

Studio support provides the browser sign-in flow. See Studio authentication for supported sign-in methods.

Test authentication

1. Restart Factory and open its public URL in a signed-out browser session.
2. Sign in through the configured provider and confirm you return to Factory.
3. Open a Factory and its sessions to confirm authenticated access works.
4. Sign out and confirm that protected pages require sign-in again.

For callback errors, see Login returns to another application. For all server variables, see Environment variables.