Document sensitive identity provider auth safety

[masnwilliams]

summary

• warn users to use established accounts and stable egress for sensitive identity providers
• recommend the default hourly health-check cadence to reduce provider security triggers

validation

• git diff --check
• docs preview not run because the Mintlify CLI is unavailable in this environment

---

Note

Low Risk
Documentation-only change with no runtime, API, or auth logic impact.

Overview
Adds a Warning under the Managed Auth FAQ’s “Which authentication methods are supported?” section, next to the existing passkey limitation callout.

It tells customers using sensitive identity providers to log in with an established account, use a stable ISP or custom proxy before login, and keep the default 1-hour health-check interval unless faster detection is required—because new accounts, changing IPs, or frequent checks can trip provider security controls.

^{Reviewed by Cursor Bugbot for commit d6b3a4e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
Kernel	🟢 Ready	View Preview	Aug 4, 2026, 3:25 PM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Error		Aug 4, 2026 3:30pm

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2dc8156. Configure here.}

[cursor]

Dense warning needs bullet list

Low Severity

This warning packs several distinct recommendations into one dense paragraph: established account, stable ISP/custom proxy, default hourly checks, and Google’s stable-egress requirement for 5-minute checks. That violates the guide rule to use a lead-in sentence plus a bullet list when 3+ separable points are packed together.

 

^{Triggered by learned rule: Use bullet lists when covering multiple distinct points in guides}

^{Reviewed by Cursor Bugbot for commit 2dc8156. Configure here.}

[cursor]

Stale comment

Risk assessment: Very Low

Verdict: Already approved — no re-approval; risk did not increase after the latest push.

Evidence (from diff only)

• 1 file changed, +4 / −0 — auth/faq.mdx only
• Adds a Mintlify <Warning> under supported authentication methods about established accounts, stable ISP/custom proxy, default 1-hour health-check cadence, and stable egress for Google 5-minute checks
• Compared with the previously approved commit (2dc8156), the follow-up commit (be52786) narrowed the PR by reverting lifecycle/FAQ wording about NEEDS_AUTH pausing scheduled checks; net surface area is smaller
• No application code, config, CI, infrastructure, OpenAPI, or auth implementation changes
• No CODEOWNERS file in this repo

Why Very Low

Documentation-only product docs with a tiny, easy-to-reason-about surface. No production logic, shared services, or infra blast radius.

Re-evaluation note

Prior automation approval remains appropriate. Risk is unchanged (still Very Low) after synchronize, so approval is left in place and not re-issued.

  

_{Sent by Cursor Automation: Assign PR reviewers}

[cursor]

Risk assessment: Very Low

Verdict: Already approved — no re-approval; risk did not increase after the latest push.

Evidence (from diff only)

• 1 file changed, +4 / −0 — auth/faq.mdx only
• Adds a Mintlify <Warning> under supported authentication methods recommending established accounts, stable ISP/custom proxy, and the default 1-hour health-check interval for sensitive identity providers
• Latest commit (d6b3a4e) only generalizes prior wording (drops Google-specific phrasing); no new files or logic
• No application code, config, CI, infrastructure, OpenAPI, or auth implementation changes
• No CODEOWNERS file in this repo

Why Very Low

Documentation-only product docs with a tiny, easy-to-reason-about surface. No production logic, shared services, or infra blast radius.

Re-evaluation note

Prior automation approval remains appropriate. Risk is unchanged (still Very Low) after synchronize, so approval is left in place and not re-issued.

  

_{Sent by Cursor Automation: Assign PR reviewers}