---
title: Flow Context
toc_max_heading_level: 5
---

Each flow execution has an independent _context_. This context holds all of the arbitrary data about that specific flow, data which can then be used and transformed by stages and policies.

## Managing data in a flow context

You create and manage the data for a context by configuring policies, stages, and bindings. As you plan your flow, and set up the required stages, etc. you are creating the context data for that flow.

For example, in the Identification Stage (part of the default login flow), you can define whether users will be prompted to enter an email address, a username, or both. All such information about the flow's configuration makes up the context.

Any data can be stored in the flow context, however there are some reserved keys in the context dictionary that are used by authentik stages.

To manage flow context on a more granular level, see [Setting flow context keys](../../../../customize/policies/types/expression/managing_flow_context_keys.md).

## Context dictionary and reserved keys

This section describes the data (the context) that are used in authentik, and provides a list of keys, what they are used for and when they are set.

:::warning
Keys prefixed with `goauthentik.io` are used internally by authentik and are subject to change without notice, and should not be modified in policies in most cases.
:::

{/* To update this file, search for `PLAN_CONTEXT_\w+\s=` in the workspace to find all definitions. */}

### Common keys

#### `pending_user` ([User object](../../../../users-sources/user/user_ref.mdx#object-properties))

`pending_user` is used by multiple stages. In the context of most flow executions, it represents the data of the user that is executing the flow. This value is not set automatically, it is set via the [Identification stage](../../stages/identification/index.md).

Stages that require a user, such as the [Password stage](../../stages/password/index.md), the [Authenticator validation stage](../../stages/authenticator_validate/index.md), and others will use this value if it is set, and fall back to the request's user when possible.

#### `prompt_data` (Dictionary)

`prompt_data` is primarily used by the [Prompt stage](../../stages/prompt/index.md). The value of any field within a prompt stage is written to the `prompt_data` dictionary. For example, given a field with the _Field key_ `email` that was submitted with the value `foo@bar.baz` will result in the following context:

```json
{
    "prompt_data": {
        "email": "foo@bar.baz"
    }
}
```

This data can be modified with policies. The data is also used by stages like [User write](../../stages/user_write/index.md), which takes data in `prompt_data` and writes it to `pending_user`.

#### `redirect` (string)

Stores the final redirect URL that the user's browser will be sent to after the flow is finished executing successfully. This is set when an un-authenticated user attempts to access a secured application, and when a user authenticates/enrolls with an external source.

#### `pending_user_identifier` (string)

If _Show matched user_ is disabled, this key will hold the user identifier entered by the user in the identification stage.

#### `application` (Application object)

When an unauthenticated user attempts to access a secured resource, they are redirected to an authentication flow. The application they attempted to access will be stored in the key attached to this object. For example: `application.github`, with `application` being the key and `github` the value.

#### `source` (Source object)

When a user authenticates/enrolls via an external source, this will be set to the source they are using.

#### `outpost` (dictionary)

When a flow is executed by an Outpost (for example the [LDAP](../../../providers/ldap/index.md) or [RADIUS](../../../providers/radius/index.mdx)), this will be set to a dictionary containing the Outpost instance under the key `"instance"`.

### Scenario-specific keys

#### `is_sso` (boolean)

This key is set to `True` when the flow is executed from an "SSO" context. For example, this is set when a flow is used during the authentication or enrollment via an external source, and if a flow is executed to authorize access to an application.

#### `is_restored` (Token object)

This key is set when a flow execution is continued from a token. This happens for example when an [Email stage](../../stages/email/index.md) is used and the user clicks on the link within the email. The token object contains the key that was used to restore the flow execution. This field is also used by the [Source stage](../../stages/source/index.md) when returning back to the initial flow the Source stage was run on.

#### `is_redirected` (Flow object)

This key is set when the current flow was reached through a [Redirect stage](../../stages/redirect/index.md) in Flow mode.

### Stage-specific keys

#### Autosubmit stage

The autosubmit stage is an internal stage type that is not configurable via the API/Web interface. It is used in certain situations, where a POST request is sent from the browser, such as with SAML POST bindings. This works by using an HTML form that is submitted automatically.

##### `title` (string)

Optional title of the form shown to the user. Automatically set when this stage is used by the backend.

##### `url` (string)

URL that the form will be submitted to.

##### `attrs` (dictionary)

Key-value pairs of the data that is included in the form and will be submitted to `url`.

#### Captcha stage:ak-version

##### `captcha` (dictionary)

When _Error on invalid score_ is set to false on a captcha stage, after the execution of the captcha stage, this object will be set in the flow context.

It contains two keys, `response` which is the raw response from the specified captcha verification URL, and `stage`, which is a reference to the captcha stage that executed the test.

#### `goauthentik.io/stages/captcha/site_key` (string):ak-version[2025.12]

#### `goauthentik.io/stages/captcha/private_key` (string):ak-version[2025.12]

Optionally set captcha site and private keys dynamically through a policy, for example when using E2E testing with a captcha stage bound.

#### Consent stage

##### `consent_header` (string)

The title of the consent prompt shown. Set automatically when the consent stage is used with an OAuth2, Proxy or SAML provider.

##### `consent_permissions` (List of PermissionDict)

An optional list of all permissions that will be given to the application by granting consent. Not supported with SAML. When used with an OAuth2 or Proxy provider, this will be set based on the configured scopes.

#### Deny stage

##### `deny_message` (string)

Optionally overwrite the deny message shown, has a higher priority than the message configured in the stage.

#### User write stage

##### `groups` (List of [Group objects](../../../../users-sources/groups/index.mdx))

See [Group](../../../../users-sources/groups/index.mdx). If set in the flow context, the `pending_user` will be added to all the groups in this list.

If set, this must be a list of group objects and not group names.

##### `user_path` (string)

Path the `pending_user` will be written to. If not set in the flow, falls back to the value set in the user_write stage, and otherwise to the `users` path.

##### `user_type` (string)

Type the `pending_user` will be created as. Must be one of `internal`, `external` or `service_account`.

#### Password stage

##### `user_backend` (string)

Set by the [Password stage](../../stages/password/index.md) after successfully authenticating the user. Contains a dot-notation to the authentication backend that was used to successfully authenticate the user.

##### `auth_method` (string)

Set by the [Password stage](../../stages/password/index.md), the [Authenticator validation stage](../../stages/authenticator_validate/index.md), the [OAuth2 Provider](../../../providers/oauth2/index.mdx), and the API authentication depending on which method was used to authenticate.

Possible options:

- `password` (Authenticated via the password in authentik's database)
- `token` (Authenticated via API token)
- `ldap` (Authenticated via LDAP bind from an LDAP source)
- `auth_mfa` (Authentication via MFA device without password)
- `auth_webauthn_pwl` (Passwordless authentication via WebAuthn with Passkeys)
- `jwt` ([M2M](../../../providers/oauth2/machine_to_machine.mdx) authentication via an existing JWT)
- `mtls` (Authentication via Certificate, see [Mutual TLS Stage](../../stages/mtls/index.md))

##### `auth_method_args` (dictionary)

Additional arguments used during the authentication. Value varies depending on `auth_method`.

Example:

```json
{
    // List of the MFA device objects used during authentication
    // applies for `auth_method` `auth_mfa`
    "mfa_devices": [],
    // MFA device used for passwordless authentication, applies to
    // `auth_method` `auth_webauthn_pwl`
    "device": null,
    // the token identifier when `auth_method` `token` was used
    "identifier": "",
    // JWT information when `auth_method` `jwt` was used
    "jwt": {},
    "source": null,
    "provider": null,
    // Certificate used for authentication
    // applies for `auth_method` `mtls`
    "certificate": {}
}
```

#### Email stage

##### `email_sent` (boolean)

Boolean set to true after the email form the email stage has been sent.

##### `email` (string)

Optionally override the email address that the email will be sent to. If not set, defaults to the email of `pending_user`.

#### Identification stage

##### `pending_user_identifier` (string)

If _Show matched user_ is disabled, this key will be set to the user identifier entered by the user in the identification stage.

#### Invitation stage

##### `invitation` (Invitation object)

The invitation used with the invitation stage. When **Continue flow without invitation** is enabled, this may be unset.

If the invitation was single-use, this object may hold a reference to an invitation that no longer exists in the database.

##### `invitation_in_effect` (boolean)

A boolean value that is `True` when an invitation has been used.

##### `token` (string)

This value can be set either via [Prompt data](#prompt_data-dictionary) or via policy to interactively/programmatically choose an invitation.

#### Redirect stage

##### `redirect_stage_target` (string)

[Set this key](../../../../customize/policies/types/expression/managing_flow_context_keys.md) in an Expression Policy to override [Redirect stage](../../stages/redirect/index.md) to force it to redirect to a certain URL or flow. This is useful when a flow requires that the redirection target be decided dynamically.

Use the format `ak-flow://{slug}` to use the Redirect stage in Flow mode. Any other format will result in the Redirect stage running in Static mode.

#### Mutual TLS Stage

##### `certificate` (dictionary):ak-version[2025.6]

This key is set by the Mutual TLS Stage during enrollment and contains data about the certificate supplied by the browser.

Example:

```json
{
    "serial_number": "1234",
    "subject": "CN=client",
    "issuer": "CN=authentik Test CA, O=authentik, OU=Self-signed",
    "fingerprint_sha256": "08:D4:A4:79:25:CA:C3:51:28:88:BB:30:C2:96:C3:44:5A:EB:18:07:84:CA:B4:75:27:74:61:19:8A:6A:AF:FC",
    "fingerprint_sha1": "5D:14:0D:5F:A2:7E:14:B0:F1:1D:6F:CD:E3:4B:81:68:71:24:1A:70",
    "raw": "-----BEGIN CERTIFICATE-----...."
}
```
