Authentication Request Preview

Overview

Vaultwarden-Plus includes a hardened trusted-device/auth-request server slice and preview notification support. The feature remains prototype-gated and is not claimed as a fully confirmed official-client end-to-end flow.

Requirements

• Explicit operator opt-in for prototype surfaces.
• Working mail transport when preview email notifications are enabled.
• Validation scope appropriate for security-sensitive auth behavior.

Configuration

Documented settings:

TRUSTED_DEVICE_PROTOTYPE_ENABLED=false
TRUSTED_DEVICE_AUTH_PROTOTYPE_ENABLED=false
TRUSTED_DEVICE_PREVIEW_EMAIL_NOTIFICATIONS=false

Keep these disabled unless performing a deliberate operator validation.

Examples

For preview notification validation, enable only the documented flags needed for the test and ensure SMTP, sendmail, or SES is working. Do not treat preview mail as proof that a full official-client challenge/redemption flow is supported.

Troubleshooting

• Full official-client end-to-end challenge/redemption remains unconfirmed.
• Strongest current client evidence is compatibility and pending polling, not full flow completion.
• Do not move auth, device-login, passkey, PRF, trusted-device, or passwordless behavior into wider use without the documented release-gate validation.

Related Pages

• Mail Preview
• SMTP Configuration
• Troubleshooting

Canonical Documentation

• Features: TDAUTH-V2 Trusted-Device And Auth-Request Hardening
• Known Limitations: TDAUTH-V2 Client Execution Gap
• Security Baseline