13 FOCUSED GUIDES
Application authentication
Connect app-user signup and login while keeping sessions, project identity and frontend state separate.
Application email/password authentication is separate from the developer dashboard login and MCP OAuth connection. The current app-user tokens are project-scoped and do not automatically expire. Do not assume built-in refresh, password reset, per-token revocation or social login; check supported behavior before designing those flows.
Explore the backend's auth model →Dashboard login and app-user login are separate
The developer dashboard account manages projects, while app-user authentication identifies people using the application you build.
Read the guide →PRACTICAL FIELD GUIDEApp signup fails because authentication is disabled
End-user authentication is enabled per project, so a valid-looking signup request can fail when that project has auth disabled.
Read the guide →PRACTICAL FIELD GUIDEHandle an email_taken response during signup
An email_taken response means the signup address already exists in that project's user store.
Read the guide →PRACTICAL FIELD GUIDEDiagnose invalid credentials without exposing passwords
An invalid_credentials response identifies a failed login, not a reason to log the submitted password.
Read the guide →PRACTICAL FIELD GUIDEVerify the current user before loading private data
A stored token and a visible user name do not prove the current API session is valid.
Read the guide →PRACTICAL FIELD GUIDEPlan around MCPBackend's non-expiring app-user tokens
Current MCPBackend app-user tokens do not expire automatically.
Read the guide →PRACTICAL FIELD GUIDEWhat local logout does and does not do
Local logout removes a session from the current client, but it is not the same as server-side token revocation.
Read the guide →PRACTICAL FIELD GUIDEA user token is rejected by another project
App-user tokens are scoped to the project that issued them.
Read the guide →PRACTICAL FIELD GUIDECreate a profile table without exposing authentication storage
Application profile fields belong in a separate model from password and login storage.
Read the guide →PRACTICAL FIELD GUIDEPlan account recovery before choosing an auth flow
Password reset is an application requirement that must be checked against the current authentication feature set.
Read the guide →PRACTICAL FIELD GUIDEAvoid racing private requests against session restoration
A private-data request can run before the app has restored and validated its session.
Read the guide →PRACTICAL FIELD GUIDEClear private cached data when users switch accounts
A frontend cache can display the previous user's records after the backend correctly changes identity.
Read the guide →PRACTICAL FIELD GUIDEWhy users sign in again after self-hosting an export
The exported runtime uses a new JWT secret, so hosted user tokens are not a session migration mechanism.
Read the guide →