Skip to main content

Require actions on next login

authentik: 2026.11.0+Enterprise

You can require a user to complete one or more flows the next time they log in, before their session is created. Typical uses are forcing a password change or requiring the user to set up an authenticator.

How it works​

The required actions are stored on the user in the goauthentik.io/user/next-actions attribute, as a single flow slug or a list of flow slugs.

When a login flow reaches the User Login stage, authentik runs each listed flow in order within the login, and then completes the login. Each flow is removed from the attribute once the user completes it, so an action only runs once.

Any flow can be used as an action, except flows with the Authentication or Invalidation designation. authentik's default flows already cover changing the password (default-password-change) and setting up the various authenticator types (for example default-authenticator-totp-setup).

For anything else, create a flow that walks the user through the action and use its slug. For example, a flow with a Prompt stage followed by a User Write stage can collect missing profile details, and a flow with a Consent stage can require the user to accept updated terms.

If a listed flow doesn't exist or its policies deny the user, the login fails until the attribute is corrected or removed. On installations without a valid enterprise license the attribute is ignored.

Require an action for a user​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Directory > Users and click the name of the user.
  3. In the Next actions on login card, select a flow and click Add. Pending actions are listed in the same card and can be removed there.

Because the actions are stored in the goauthentik.io/user/next-actions attribute, they can also be set by editing the user's Attributes field directly, through the user API, a blueprint, or from within a flow, for example with a User Write stage in an enrollment flow:

goauthentik.io/user/next-actions:
    - default-password-change