Tenant Configurations

Wristband allows you to override granular configurations at the individual tenant level. To understand how this hierarchical configuration model operates, please review the Tenant Override System documentation. The sections below detail every tenant-level configuration supported by Wristband.

Authentication Session Policies

Wristband creates an authentication session upon successful login. Users with an active session who are redirected back to the login page bypass credential entry entirely. At the tenant level, you can configure the idle and absolute expiration times, as well as whether the session cookie is persistent.

Bot Detection Policies

Wristband's bot detection policies protect tenants from automated attacks and credential stuffing by enforcing CAPTCHA verification during login. While CAPTCHA cannot be fully disabled at the application level for Production applications, you can completely bypass or modify this restriction for specific tenants by enabling a per-tenant bot detection policy override.

Email Branding

Wristband automatically dispatches transactional emails for critical authentication flows, such as password reset links when a user forgets their credentials. With Wristband's email branding configurations, individual tenants can fully customize the visual appearance of these emails—including the sender domain, logo, and action button colors.

Email Policies

Beyond visual styling, you can manage the behavioral policies for actionable links embedded in transactional emails. Each email template supports its own distinct email policy, allowing you to customize two primary parameters:

• Expiration Time: Control how long a link remains valid (e.g., setting a short 15-minute window for password resets, but allowing 7 days for user invitations).
• Destination URL: Define where the user is redirected after clicking the link.

Identity Providers

Each tenant can be configured with their own unique set of identity providers. When users navigate to a tenant's login page, they can only authenticate using the identity providers enabled for that tenant.

Consider this scenario: You have an application with three tenants—Tenant A, Tenant B, and Tenant C. The first two are large organizations requiring single sign-on (SSO) via their own enterprise identity providers. Meanwhile, Tenant C prefers to use Wristband as their primary identity provider.

To satisfy these requirements, you can simply configure Wristband as the default identity provider at the application level (inheriting down to Tenant C), and then apply tenant overrides to route Tenant A and Tenant B to their respective enterprise identity providers.

Multi-Factor Authentication (MFA)

MFA policies determine whether multi-factor authentication is mandatory for a tenant's users. When enabled, users must register a secondary factor and complete a verification challenge during login. These policies also dictate which specific authentication factors users are permitted to enroll in—such as TOTP (Time-based One-Time Password) or recovery codes.

Page Branding

Wristband supports full, per-tenant customization for all hosted authentication pages, including login and signup. For B2B applications, this allows you to completely white-label the authentication experience to match each customer's brand guidelines with custom logos, unique color schemes, and tailored background images. Providing fully branded authentication pages delivers a distinct competitive advantage, making your software significantly more attractive to enterprise companies.

Password Policies

Password policies define the rules and security requirements governing how users create and manage their passwords. To satisfy diverse compliance standards, each tenant can enforce its own unique set of password policies. Supported configurations include the following:

Role Assignment Policies

Wristband's role assignment policies allow tenants to establish automated rules for provisioning user roles. You can currently configure the following policy rules:

• Default Signup Roles: The specified roles are automatically assigned to users upon successful completion of the self-signup flow.
• Default IdP User Sync Roles: The specified roles are assigned to users when they are synced from an external identity provider (IdP), such as during Just-In-Time (JIT) provisioning in enterprise SSO flows. Note, these default roles are only applied if no other explicit role mappings exist.

User Schema

The user schema defines the structural constraints and validation rules for user profile fields. Modifying this schema allows you to change whether specific fields are optional or required. Wristband dynamically adapts its core authentication flows to mirror your schema adjustments. For example, if you mark the given_name field as required, Wristband will automatically update its signup and invitation flows to prompt users for that information.

Below is the list of user schema fields whose requirement status can be customized:

• Birthdate
• FamilyName
• FullName
• GivenName
• PhoneNumber
• Username

Workflow Policies

Wristband supports per-tenant configuration of authentication workflows, allowing you to tailor the login experience to each customer's operational needs. For example, if a tenant imports a large batch of users without passwords, the administrator can set the missing password remediation strategy in the Login Workflow Policy to REQUIRE_PASSWORD_RESET. Wristband will then automatically intercept login attempts from these passwordless users and seamlessly route them into the password reset flow.

Below is the list of authentication workflows that can be customized at the tenant level:

• Signup
• Login
• Enterprise External IDP Login (SSO)
• Password Reset
• New User Invitation
• Existing User Invitation
• Change Email