What is authentication?

Authentication is the process of confirming that the person accessing a form is who they say they are. In CX Platform, authentication sits in the Access and Authentication section of a form template's Details tab and works alongside access mode, MFA, and KYC settings to control who can reach a form and what they need to prove before they can interact with it.

Authentication is distinct from access mode. Access mode controls whether a form is publicly available or restricted to private/API delivery. Authentication controls what the user must verify once they've reached the form. A public form can still require authentication — and a private form can have no authentication at all.

‍

Authentication mode options

‍

None

No authentication is required. The user can access the form and interact with it straight away, without needing to verify anything.

This is the default for public forms where there's no sensitive data and no need to confirm who the user is — general enquiries, feedback forms, open registrations, and similar.

‍Use when: the form is public, doesn't contain personal or sensitive data, and you don't need to confirm the user's identity before they submit.

‍

Match to prefill data

The user must answer one or more questions that are checked against data supplied when the form was created — for example, surname and date of birth. If their answers match the pre-supplied data, authentication passes and the form proceeds. If they don't match, access is denied.

This is the most common authentication mode for private forms delivered via personalised links. Questions used for authentication are marked as authentication questions in the Form Designer — they appear on the form as normal inputs but their answers are validated against the prefill payload rather than just submitted.

‍Use when: the form is Private / API and delivered with prefilled data. You want to confirm the user is the intended recipient before they can interact with personalised content — without requiring them to have a platform account.

‍

How authentication works with other settings

Authentication mode is one layer in a broader access and verification stack. Here's how it sits alongside the other settings in the Access and Authentication section:

‍

These layers are independent and can be combined. A common high-assurance setup uses all four: a private form delivered via personalised link, authentication by matching prefill data, SMS MFA, and KYC.

‍

Authentication and prefill data

When Match to prefill data is selected, the authentication step acts as a gate — not just a check. Prefilled data can be held back until authentication passes, using the Require authentication for prefill data setting in the Prefill Data Settings section below.

This means even if someone opens a personalised link that shouldn't be theirs, they can't see the pre-populated account details until they've answered the authentication questions correctly. See the Prefill Data Settings and Authentication guide for how to configure this.

‍

Marking questions as authentication questions

When using Match to prefill data mode, you need to tell the form which questions are being used for authentication. This is done in the Form Designer.

Open the field you want to use as an authentication question, go to the Data tab, and tick Is authentication field?. The field will still appear as a normal input on the form, but the user's answer will be validated against the prefill payload rather than just recorded as a submission value.

‍

‍Common authentication fields: Surname and date of birth are the most frequently used authentication fields because they're easy for the genuine user to answer but hard for someone else to guess. Account number or membership number are also common — particularly for services where the form link is sent to a verified contact method.

Authentication mode is the foundation of a secure private form. Whether you use it alone or as the first step in a multi-layer verification flow, choosing the right mode — and configuring the questions behind it correctly — is what turns a personalised link into a genuinely secure interaction.

‍