Authentication

Add user accounts to your published app. Users can sign up, log in, and access data based on their role.

Enable authentication in your app's Config tab. Once enabled, users can sign up and log in. Their identity is automatically passed to access rules and backend functions.

How It Works

User signs up

With email, password, and optional custom fields (name, company, etc.).

JWT token issued

A signed JWT token is stored in a secure httpOnly cookie. Valid for 7 days with automatic refresh.

Identity flows through

Every API call from the SDK automatically includes the token. Access rules evaluate against the user's identity, role, and profile data.

Enabling Authentication

Go to your app's Config tab in the dashboard
Toggle Enable Authentication on
Optionally configure custom signup fields (e.g., "Company", "Phone")
Publish your app for the changes to take effect

When auth is enabled, your app automatically gets login and signup pages. You don't need to build them yourself.

Signup & Login

Feature	Details
Email/Password	Default auth method. Password requires 8+ characters, uppercase, lowercase, and a digit.
Custom signup fields	Add fields like Name, Company, Phone to the signup form. Stored in the user's profile data.
Token expiry	7 days. Tokens refresh automatically.
Logout all sessions	Increment the user's `tokenVersion` to instantly invalidate all existing tokens.
Custom auth paths	Only `login` and `signup` page paths are configurable. Forgot-password, reset-password, and verify-email always live at their default paths.
Social login	Not implemented. The "Allow social login" toggle exists in Config but has no effect — email/password is the only method.

Roles

Roles are first-class, per-project entities with stable IDs — not a free-text list on the user's profile. Create a role, then assign it to users; access rules reference the role's ID.

Common roles:

admin — Full access to manage all data
editor — Can create and modify content
viewer — Read-only access

Define any custom roles from the dashboard, then use the has_role access rule (with the role's roleId) to restrict access.

A custom signup field named roles does nothing — role membership never comes from profile data a user can submit. Roles are only granted by the app owner, from the Users tab or via assignRoleToAppUser.

Manage user roles from the dashboard under your app's Users section. See Access Control for how to use roles in access rules.

Using Auth in Your App

The SDK provides auth methods in your published app:

// Import user from the SDK
import { user } from '../api/sdk';

// Get current user
const me = await user.me();
// { id, email, name, role, profileData, roleIds, roles, isAppSuperAdmin, emailVerified, createdAt } or null

// Login with credentials
await user.loginWithCredentials(email, password);

// Or redirect to login page
user.login();

// Signup
await user.signup(email, password, name);

// Logout
await user.logout();

Signup and login also return the token directly in the response body (in addition to setting the cookie) — useful for apps on a custom domain that can't rely on a first-party cookie.

Security Details

Passwords hashed with bcrypt

Passwords are never stored in plain text.

JWT tokens in httpOnly cookies

Tokens cannot be accessed by JavaScript, preventing XSS attacks.

Project-scoped tokens

Each token includes the project ID. Tokens from one app cannot be used on another.

Instant session revocation

Increment tokenVersion to invalidate all sessions for a user immediately.