IAM authentication events in Audit Trail

Reviewed on October 01, 2025

This page explains how to differentiate IAM members authentication methods and understand and how they appear in Audit Trail.

This page only covers Unauthenticated API methods that actually perform and/or complete an authentication step.

Authentication code login

This flow allows a user to log in using an authentication code sent via email.

• InitiateMagicCodeLogin Sends the user an email containing a 6-digit authentication code.

• CreateMagicCodeLogin Authenticates the user based on their username and the 6-digit authentication code received.

If multifactor authentication (MFA) is required, the flow proceeds to CheckLoginMFAOTP. Otherwise, the flow redirects to CommitLogin.

Password login

This method allows you to authenticate using a username and password.

• CreatePasswordLogin Authenticates the user with their username and password.

If MFA is required, the system verifies it through CheckLoginMFAOTP. If not, the flow continues directly to CommitLogin.

OAuth2 login

This flow is based on external OAuth2 authentication providers.

• InitiateOAuth2Login Redirects the user to the external OAuth2 provider for authentication.

• CreateOAuth2Login Finalizes authentication once the OAuth2 provider confirms the user identity.

As with the other methods, if MFA is required, CheckLoginMFAOTP is triggered before committing the login. Otherwise, the flow continues to CommitLogin.

SAML login

This flow integrates with SAML (Security Assertion Markup Language) for Single Sign-On (SSO). It allows you to set up identity federation on your Organization and provide your teams with secure access to their accounts via an Identity Provider (IdP).

• InitiateSamlLogin Starts the SAML login and redirects the user to the IdP.

• CreateSamlLogin Finalizes authentication once the SAML response is received and validated.

As with the other methods, if MFA is required, CheckLoginMFAOTP is triggered before committing the login. Otherwise, the flow continues to CommitLogin.

Common steps

• CheckLoginMFAOTP Validates the Multi-Factor Authentication one-time password (OTP) if required.

• CommitLogin The final step of the login process. Transforms the authenticated session into a JWT (JSON Web Token).

• RenewJWT Exchanges a valid login session/refresh context for a new JWT without re-authenticating credentials. JWTs are valid for 1 hour. If a member refreshes the Scaleway console or performs actions more than 1 hour after the last creation or update of a JWT, the JWT will be renewed.

Summary of authentication methods