diff --git a/README.md b/README.md
index 37dd42fc..6322cffd 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ UltimateAuth is an open-source auth framework with platform-level capabilities t
| Security Expansion | 0.3.0 | MFA, Reauth | 🟡 In Progress | Q1 2027 |
| Infrastructure Expansion| 0.4.0 | Redis, Distributed Cache, Password Hashers | 🔜 Planned | Q1 2027 |
| Multi-Tenant Expansion | 0.5.0 | Multi tenant management | 🔜 Planned | Q2 2027 |
-| Extensibility Expansion | 0.6.0 | Audit, events, hooks | 🔜 Planned | Q2 2027 |
+| Extensibility Expansion | 0.6.0 | Audit, Passwordless Login | 🔜 Planned | Q2 2027 |
| Performance Expansion | 0.7.0 | Benchmarks, caching | 🔜 Planned | Q3 2027 |
| Ecosystem Expansion | 0.8.0 | Migration tools | 🔜 Planned | Q3 2027 |
| v1.0 | 1.0.0 | Locked API, align with .NET 12 | 🔜 Planned | Q4 2027 |
@@ -62,9 +62,9 @@ UltimateAuth is designed to deliver a simple, consistent developer experience fr
| Milestone | Version | Target |
|---|---|---|
| **Developer Foundation** | 0.1.x | A functional, security-conscious authentication framework with a complete core architecture, extensibility, and a developer-first API. Suitable for development, early adoption, and production use following application-specific evaluation. |
-| **Production Expansion** | 0.2.0 | Ready to power real-world applications, particularly small and medium-sized products, with expanded authentication modes, built-in rate limiting, and a proven integration experience. Larger applications can also adopt UltimateAuth when its available capabilities meet their requirements. |
-| **Advanced Security & Scale** | 0.4.0 | Extends production capabilities with MFA, reauthentication, distributed infrastructure, and additional security options for applications with more demanding requirements. Builds on the same simple developer experience. |
-| **Migration & Adoption** | 0.8.0 | Makes adopting UltimateAuth in existing applications easier through migration tools, guidance, and established integration patterns, without requiring new applications to wait for this milestone. |
+| **Production Expansion** | 0.2.x | Ready to power real-world applications, particularly small and medium-sized products, with expanded authentication modes, built-in rate limiting, and a proven integration experience. Larger applications can also adopt UltimateAuth when its available capabilities meet their requirements. |
+| **Advanced Security & Scale** | 0.4.x | Extends production capabilities with MFA, reauthentication, distributed infrastructure, and additional security options for applications with more demanding requirements. Builds on the same simple developer experience. |
+| **Migration & Adoption** | 0.8.x | Makes adopting UltimateAuth in existing applications easier through migration tools, guidance, and established integration patterns, without requiring new applications to wait for this milestone. |
**The UltimateAuth philosophy:** Simple from day one, more capable with every release. Version milestones describe expanding capabilities — not a progression from difficult to easy, or from unusable to usable.
@@ -225,25 +225,20 @@ Change `Components/Pages/Home.razor`:
We recognize your account. Your Identity Lab workspace is ready whenever you are.
-
*@
-
-
+
@if (IsLockedOut)
{
@@ -174,7 +165,7 @@
-
+
+ @* Do not add loginbusy disabled to the text and password fields, it will prevent the form from submitting with required fields. *@
@(IsLockedOut ? "Temporarily locked" : "Sign In")
-
diff --git a/docs/content/client-sdk/authentication.md b/docs/content/client-sdk/authentication.md
index 5bbb830c..b148a282 100644
--- a/docs/content/client-sdk/authentication.md
+++ b/docs/content/client-sdk/authentication.md
@@ -895,23 +895,59 @@ The component supports password-based login, PKCE completion through UAuthHub, c
### Basic Usage
-A login form can be implemented with the following component:
+`UAuthLoginForm` provides a complete, ready-to-use login form out of the box. No additional markup or credential bindings are required.
+
+```razor
+
+```
+
+That's it. UltimateAuth automatically renders the identifier field, password field, and submit button, and handles the authentication submission workflow.
+
+**Customizing the Form**
+
+When you need a custom layout or styling, simply provide your own form content:
```razor
@using CodeBeam.UltimateAuth.Client.Blazor
-
-
-
+
+
+
-
-@code {
- private string email = "";
- private string password = "";
-}
```
+UltimateAuth handles the authentication workflow in both cases. Your custom fields only need the correct HTML `name` attributes; there is no need to bind credentials to Blazor component state.
+
+### Native Credential Submission
+
+`UAuthLoginForm` reads credentials directly from native browser form fields. It does not accept `Identifier` or `Secret` component parameters.
+
+When providing custom `ChildContent`, the form must contain enabled input elements with the exact names `Identifier` and `Secret`.
+
+Credential values should not be bound to Blazor component state solely for submission. This is particularly important in Blazor Server, where interactive component bindings can transmit credential values over the SignalR connection.
+
+**Important: Do Not Disable Credential Fields During Submission**
+
+HTML inputs marked as `disabled` are excluded from `FormData` and native form submissions.
+
+Do not set `Disabled="@isSubmitting"` on the username or password fields. A login preview may succeed, but the subsequent native commit can fail because the credential fields are missing from the submitted form.
+
+Instead, disable the submit button while leaving the credential inputs enabled.
+
+If you need to prevent editing during submission, consider `readonly` where supported, while accounting for component behavior, browser autofill, and accessibility.
+
+**Custom Form Requirements**
+
+- Use `name="Identifier"` and `name="Secret"` exactly.
+- Keep both credential inputs enabled throughout submission.
+- Avoid duplicate inputs with these names.
+- Use `type="password"` and `autocomplete="current-password"` for password fields.
+- Keep custom submit controls inside `UAuthLoginForm`.
+- Use `OnSubmittingChanged` to manage loading indicators and submit-button state.
+
+`UAuthLoginForm` handles the try and commit orchestration. The native commit includes the browser form fields, device information, and antiforgery data required by the configured authentication flow.
+
The component automatically uses `TryAndCommit` as its default submission mode.
When submitted, it:
@@ -934,13 +970,13 @@ For example, with MudBlazor:
@using CodeBeam.UltimateAuth.Client.Blazor
@using CodeBeam.UltimateAuth.Client
-
+Sign in
-
-
+
+
- Sign in
+ Sign in
@if (!string.IsNullOrWhiteSpace(error))
{
@@ -950,10 +986,15 @@ For example, with MudBlazor:
@code {
- private string email = "";
- private string password = "";
+ private bool _isSubmitting;
private string? error;
+ private Task HandleSubmittingChanged(bool submitting)
+ {
+ _isSubmitting = submitting;
+ return Task.CompletedTask;
+ }
+
private Task HandleLoginResult(IUAuthTryResult result)
{
error = result.IsSuccess ? null : "Unable to sign in.";
@@ -973,7 +1014,7 @@ Because the component renders an HTML form internally, place the submit button i
Use `SubmitMode` to control how the authentication attempt is executed.
```razor
-
+
...
```
@@ -995,7 +1036,7 @@ For interactive login forms that need validation feedback, it is generally the r
The component exposes an `OnTryResult` callback:
```razor
-
+
...
```
@@ -1059,9 +1100,9 @@ The same component also supports PKCE login completion when hosted within a supp
Set `LoginType` to `Pkce`:
```razor
-
-
-
+
+
+
```
@@ -1085,7 +1126,7 @@ A Blazor WebAssembly application should initiate PKCE using `BeginPkceAsync`; th
You can provide an explicit return URL:
```razor
-
+
...
```
@@ -1103,7 +1144,7 @@ This allows a shared login component to participate in different authentication
For advanced integrations, the `Endpoint` parameter allows the form's HTML action endpoint to be overridden:
```razor
-
+
...
```
@@ -1117,9 +1158,9 @@ Note that `Endpoint` affects the form's HTML action. Try-based submissions invok
`UAuthLoginForm` exposes `SubmitAsync`, allowing submission through a component reference.
```razor
-
-
-
+
+
+