Authentication

Built in, when you want it

Authentication is a capability you turn on when you want it: ask your agent, switch it on under Project settings → Capabilities (the wiring runs as a tracked task), start from a template like AuthBot that ships with it, or choose it during Advanced setup. When it's on, your app doesn't get a login form bolted on later — it ships with a working authentication system: sign-in with emailed codes and magic links, passwords, Google, and guest access, plus session management and protected routes, all wired in and working. Client-only apps like the game starters skip it entirely.

Each environment has its own users

Sign-ups are isolated per environment, because each environment has its own database. Accounts you create while testing in your sandbox or development environment never appear among your production users — so you can register, reset passwords, and experiment freely without polluting the real thing. In the sandbox, auth runs entirely locally and never sends real email.

Roles and permissions

Ask your agent for roles like admin and member, and it guards pages, API operations, and data access consistently across the entire app. Changing who can see what is a sentence, not a sprint.

Your sign-in emails

The magic link, confirmation, and password recovery emails your app sends are yours to shape: edit their templates on the project's Emails page, and send them from your own domain once it's connected. Spaceboy validates that every template keeps its sign-in link or code intact.

Choosing sign-in methods

Project settings → Sign-in methods controls which options your app's login page offers: emailed codes and magic links, passwords, guest access, and social sign-in with Google, Apple, GitHub, Facebook, Discord, X, or LinkedIn. Toggle what you want and save — the login page updates without a redeploy, and at least one method always stays enabled so nobody gets locked out.

Social providers need app credentials connected under Connections. Each provider's connect walkthrough shows the exact callback URL to register, ready to copy — one stable URL that covers all your environments.

Seeing your users

The Users page in the dashboard lists the real accounts in each deployed environment — display name, email, sign-in methods, when they joined, and when they were last seen. It's read-only and searchable, and because every environment has its own users, the picker at the top lets you flip between development and production sign-ups.

Going live with auth

Building an app with authentication is free — the sandbox and preview work on every account. When you publish it, it goes live as an app at $20/month. One more production detail: Google sign-in on your production site uses your own Google credentials, connected once under Connections.