# Auth

> How app users, sessions and roles work at the API level.


Each app has its own user directory, separate from Draftship accounts.

## Accounts

- `register` creates a user with email, password (8+ characters) and optional `full_name`, and signs them in.
- `loginViaEmailPassword` returns a session token, stored by the browser SDK in `localStorage` and sent as `Authorization: Bearer <token>`.
- Tokens are signed, scoped to one app and valid for 30 days.
- `updateMe` stores extra profile fields on the user (available in rules as `user.data.<field>`). Email, role and id can't be changed this way, and neither can a field your access rules read. Set those from a backend function with `users.update(id, data)`.

## Roles

`user` (default) or `admin`. The first account registered with the owner's Draftship email becomes admin automatically. Change roles in **Dashboard → Users**.

## In functions

`getUser(req)` from the server SDK resolves the caller from the request's Bearer token, or returns `null`.