Your users' accounts
They sign up to your site — not to our system — and everyone comes in as an ordinary user.
Every app manages its own users. Somebody who signs up to your site gets no account with us, and sees nothing from any other site. A session token from one site means nothing on another.
The process
- Sign up with an e-mail address and a password
- Get a six-digit code by e-mail, valid for fifteen minutes
- Confirm, and you are in
Who becomes an admin
Nobody, on their own. Everyone who signs up comes in as an ordinary user, and the admin role is granted only by you — on the “Users” screen, on that person's row, or in advance in a personal invitation.
The first person to sign up used to become an admin automatically. That was removed: an app is live from its first build, so “the first to sign up” was in practice the first stranger who found the address.
If the code never arrived
When no e-mail service is configured, the code is written to the project log and only you can see it there. That lets you help somebody who is stuck without exposing anything outward.
Removing a user cancels every one of their sessions immediately. A token left in their browser stops working at that moment.