- **Authentication**: this option designates a flow to be used for authentication. The authentication flow should always contain a [**User Login**](../../stages/user_login/index.md) stage, which attaches the staged user to the current session.

- **Authorization**: designates a flow to be used for authorization of an application. Can be used to add additional verification steps before the user is allowed to access an application. This flow is defined per provider, when the provider is created, to state whether implicit or explicit authorization is required.

- **Enrollment**: designates a flow for enrollment. This flow can contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or **Captcha**. At the end, to create the user, you can use the [**User Write**](../../stages/user_write.md) stage, which either updates the currently staged user, or if none exists, creates a new one.

- **Invalidation**: designates a default flow to be used to invalidate a session. There are two default invalidation flows:
    - `default-invalidation-flow`: Used when a user logs out directly from authentik. This flow **includes** a [**User Logout**](../../stages/user_logout.md) stage, which ends the authentik session and triggers [Single Logout](../../../providers/single-logout/index.md) for all connected applications.

    - `default-provider-invalidation-flow`: Used when a user logs out from an application (OIDC, SAML, Proxy, or RAC providers). By default, this flow does **not** include a User Logout stage, meaning only the specific application session ends while the authentik session remains active. For instructions on how to also end the authentik session when a user logs out from an application, see the [Single Logout documentation](../../../providers/single-logout/index.md#enable-full-single-logout-for-rp-initiated-logout).

    You can also create custom invalidation flows with branded background images or different logout options.

- **Recovery**: designates a flow for recovery. This flow normally contains an [**Identification**](../../stages/identification/index.mdx) stage to find the user. It can also contain any amount of verification stages, such as [**Email**](../../stages/email/index.mdx) or [**CAPTCHA**](../../stages/captcha/index.md). Afterwards, use the [**Prompt**](../../stages/prompt/index.md) stage to ask the user for a new password and the [**User Write**](../../stages/user_write.md) stage to update the password.

- **Stage configuration**: designates a flow for general setup. This designation doesn't impose any constraints on what you can do. For example, by default this designation is used to configure authenticators, like changing a password and setting up TOTP.

- **Unenrollment**: designates a flow for unenrollment. This flow can contain any amount of verification stages, such as [**email**](../../stages/email/index.mdx) or [**Captcha**](../../stages/captcha/index.md). As a final stage, to delete the account, use the [**user_delete**](../../stages/user_delete.md) stage.
