Apps: Securing your app
Managing login and registration
Choose who can open your app, how people sign in, confirm emails, reset passwords, invite people and approve access requests.
Choose who can open your app, how people sign in, confirm emails, reset passwords, invite people and approve access requests.
Open Dashboard → Login & access to choose who can open your app and how people sign in. Changes apply right away, without a rebuild.
| Setting | Who gets in | Sign-in |
|---|---|---|
| Public | anyone | only where your app asks for it |
| Sign-in required | anyone with an account | before they see anything |
| Private (Pro) | people you invite or approve | before they see anything |
With sign-in required or private, visitors who aren't signed in land on your app's sign-in page (/_ds/login on your app's address). Every request to your app's data is checked too, not just the pages. These apps are kept out of search results.
SSO providers must publish signing keys through OpenID Connect discovery, support authorization-code sign-in with PKCE (S256), and return a signed ID token containing a verified email address. Draftship checks the issuer, audience, expiration and login nonce. Complete sign-in in the browser where you started it; the platform uses a short-lived, HTTP-only cookie to bind the callback to that browser. Provider URLs must use HTTPS, except for the bundled local test provider in development.
Draftship hosts a sign-in page for every app with sign-in, sign-up, email confirmation, password reset, Google and SSO, styled with your brand color. Your app can link to it with ds.auth.redirectToLogin(), and people return to the page they came from.
If your app has its own sign-in screens, ask the AI to add the parts you need: Google or SSO buttons, a code field for email confirmation, or "Forgot password?". See the SDK reference.
"Forgot password?" emails a link that opens a reset page on your app's address. Links work once, for one hour. Choosing a new password signs the person out on every other device. People who signed up with Google or SSO can use it to add a password.
From Dashboard → Users, the key icon emails a reset link to anyone.
In Dashboard → Users → Invite people, enter email addresses and pick a role. Invited people get an email with a link to create their account with that address. You can invite up to 50 people a day. Password sign-up for an invitation requires email confirmation; configure email delivery before inviting people to a live app. A verified Google or SSO identity also proves the email address.
On a private app, people who sign up without an invite become access requests. People who already had an account before you made the app private keep access; block them to remove it. Approve or decline them in Dashboard → Users; approved people can sign in once their email is confirmed.
Dashboard → Users shows each person's role, status (active, email not confirmed, blocked), sign-in method and last sign-in. From there you can:
When you preview a private app in Draftship, you're signed in as its admin automatically.
Confirmation codes, reset links and invites are sent from your app's name. They need email sending set up on your Draftship server (RESEND_API_KEY and EMAIL_FROM).