If you’re curious how Veil works, I made an screencast where I use it with an existing Phoenix application: https://elixircasts.io/passwordless-authentication-with-veil

Sure! Veil adds a new mix task that you run with mix veil.add. This then does the following:

• Adds schemas for Veil.User, Veil.Request, Veil.Session
• Adds User & Session controllers & views
• Adds a mailer
• Adds three Plugs
• Adds HTML templates (if your phoenix app has a templates directory)
• Amends your config file to add the Veil-specific settings
• Amends the default layout.html.eex to add a sign in link
• Amends your router to add one of the Plugs to the default pipeline, and adds two new blocks: one for Veil’s sign in/session routes, and one that only signed in users can access.

It also includes code to generate unguessable unique secure ids for requests and sessions, and this code isn’t copied to your app (since it doesn’t need modifying).

In practical terms, this gives you:

• A sign in/signup form (email address only) that sends an email to the address given
• Clicking the link in that email will sign the user into the application and set a session id in a cookie
• You can then add protected routes in the new router block that will only be accessible to logged in users

Regarding email providers, it uses Swoosh by default, which includes the following adaptors for different services: Sendgrid, Mandrill, Mailgun, Postmark, SparkPost, and SMTP.

Please let me know if you have any further questions.

Good question. Honestly, if you have already set up your own authentication by email, then it probably makes sense to continue using that. This isn’t a terribly hard problem, so if you’ve already done the work it’s unlikely that you want to switch.

That said, it may have a few advantages over your solution (guessing of course):

• Secure request/session ids that can easily be invalidated server-side.
• Login requests are also stored in the database, so it is easy to see failed login attempts (although these are deleted by a task daily, it would be easy to add another task to email a list of users with multiple failed attempts to the website admin daily).

I think the main advantage comes if you are starting a new project - you can be set up in 5 minutes without needing to roll your own method.

If you have a few minutes free, maybe try creating a new project with Veil included and see if it works significantly differently. If your method is better in any way I’d love improvement suggestions!

Just watched the ElixirCast and was up and running with Veil in under 10 minutes! Really fantastic on-boarding experience, wish that other auth solutions shared Veil’s ease-of-use…

Has anyone “outgrown” Veil and incorporated other authentication solutions such as OAuth? Curious how much pain there will be down the line if I decide to build a more fully featured authentication suite for my app…

Thanks for the library!

But how is it better than using bamboo and a single controller? That’s how I do authentication over email right now. I guess what I’m asking is, if I already have passwordless authentication set up, should I switch to your library?