Skip to contentNewLaunching soon on Product Hunt (opens in a new tab)
Auth & UsersAll sections

Auth & Users

Auth & Users lets people create an account in your app and sign in, with an email and password or a social provider. It issues the session tokens your database rules read, and lists everyone who signed up so you can reset a password or block an account.

In the console: Build › Auth & UsersUpdated October 12, 2026

Walkthrough coming soonA 20-second tour of Auth & Users will play here.

Why you need it

Most apps need to know who is asking before they show or change anything. Building that yourself means password hashing, sessions, reset emails and OAuth flows, and a mistake in any of them is a security problem rather than a bug. Auth & Users gives each project its own user system, separate from your Backenly account, and your database rules use its tokens to decide which rows each person can see.

For example

  • Customers sign up with an email and password, and reset a forgotten password by email.
  • Visitors sign in with Google or GitHub through your own OAuth app.
  • A user reports a problem, and you find their account, send a password reset or block it.
  • A B2B product gives each customer company its own organization, with members and roles.

How it works

  1. Your agent turns it on

    Email and password sign-up becomes active when your agent adds it, or when the first person signs up from your app.

  2. People sign up from your app

    Through the SDK or /api/v1/{projectId}/auth/*. Passwords are hashed with bcrypt, and identities live in your project’s own schema.

  3. Each session is a signed token

    Signed with your project’s own secret, never Backenly’s. Your app sends it as X-User-Token, and every row-level security policy reads it.

  4. You manage people in the console

    The Users tab lists everyone who signed up. Signing out revokes a session on the server, and a blocked user cannot sign in.

Try it

Once your coding agent is connected, ask it:

Ask your agent
Add email and password sign-up and sign-in to my app, with password reset by email.
Ask your agent
Add organizations with members and roles, so each company only sees its own data.
From your app
await backend.auth.signUp({ email, password })
await backend.auth.signIn({ email, password })

// From here on the SDK sends the user's token,
// so your row-level security rules apply.

Good to know

  • The people who use your app and your own Backenly account are two separate systems. They share no tables and no tokens.
  • Google and GitHub sign-in can be set up in the console, and your agent can also add Discord or Facebook. Each uses your own OAuth app, and its secret is stored encrypted for the project.
  • Verification, password reset and magic link emails can go out through your own SMTP server with your own templates. A test send in the console confirms the settings actually deliver.
  • The users table is managed here and is never served at /db/users, because it holds password hashes.