Authentication

Built in, when you want it

Authentication is a capability you choose during project setup (or start from a template like AuthBot that ships with it). When it's on, your app doesn't get a login form bolted on later — it ships with a working authentication system from the very first preview: sign-in with emailed codes and magic links, passwords, Google, and guest access, plus session management and protected routes, all wired in and working. Client-only apps like the game starters skip it entirely — and you can ask your agent to add it later.

Each environment has its own users

Sign-ups are isolated per environment, because each environment has its own database. Accounts you create while testing in your sandbox or development environment never appear among your production users — so you can register, reset passwords, and experiment freely without polluting the real thing. In the sandbox, auth runs entirely locally and never sends real email.

Roles and permissions

Ask your agent for roles like admin and member, and it guards pages, API operations, and data access consistently across the entire app. Changing who can see what is a sentence, not a sprint.

Your sign-in emails

The magic link, confirmation, and password recovery emails your app sends are yours to shape: edit their templates on the project's Email Templates page, and send them from your own domain once it's connected. Spaceboy validates that every template keeps its sign-in link or code intact.

Choosing sign-in methods

Project settings → Sign-in methods controls which options your app's login page offers: emailed codes and magic links, passwords, guest access, and social sign-in with Google, Apple, GitHub, Facebook, Discord, X, or LinkedIn. Toggle what you want and save — the login page updates without a redeploy, and at least one method always stays enabled so nobody gets locked out.

Social providers need app credentials connected under Integrations. Each provider's connect walkthrough shows the exact callback URL to register, ready to copy — one stable URL that covers all your environments.

Seeing your users

The Users page in the dashboard lists the real accounts in each deployed environment — display name, email, sign-in methods, when they joined, and when they were last seen. It's read-only and searchable, and because every environment has its own users, the picker at the top lets you flip between development and production sign-ups.

Going live with auth

Apps with authentication need provisioned infrastructure, so deploying them requires the Starter plan or above (the sandbox works on every plan). One more production detail: Google sign-in on your production site uses your own Google credentials, connected once under Integrations.