# Managing login and registration

> Choose who can open your app, how people sign in, confirm emails, reset passwords, invite people and approve access requests.


Open **Dashboard → Login & access** to choose who can open your app and how people sign in. Changes apply right away, without a rebuild.

## Who can open the app

| Setting | Who gets in | Sign-in |
|---|---|---|
| **Public** | anyone | only where your app asks for it |
| **Sign-in required** | anyone with an account | before they see anything |
| **Private** (Pro) | people you invite or approve | before they see anything |

With sign-in required or private, visitors who aren't signed in land on your app's sign-in page (`/_ds/login` on your app's address). Every request to your app's data is checked too, not just the pages. These apps are kept out of search results.

## Sign-in methods

- **Email and password**, with "Forgot password?" built in.
  - **Confirm emails with a 6-digit code**: after signing up, people enter a code from their email. It works once, for 10 minutes, and allows 5 tries. "Send a new code" replaces it. Optional for ordinary public-app sign-ups; always required for private apps, invited people and administrator sign-ups. People can't sign in until they confirm.
- **Google:** one click, no password or code. Available when the Google connector is set up on your Draftship server.
- **Single sign-on (SSO)** (Pro+): Microsoft Entra ID, Okta, Google Workspace or any OpenID Connect provider. Enter the issuer URL, client ID and secret, and register the redirect URL shown with your provider. You can limit sign-in to company email domains, and let everyone who signs in with SSO into a private app without an invite.

SSO providers must publish signing keys through OpenID Connect discovery, support authorization-code sign-in with PKCE (`S256`), and return a signed ID token containing a verified email address. Draftship checks the issuer, audience, expiration and login nonce. Complete sign-in in the browser where you started it; the platform uses a short-lived, HTTP-only cookie to bind the callback to that browser. Provider URLs must use HTTPS, except for the bundled local test provider in development.

## The sign-in page

Draftship hosts a sign-in page for every app with sign-in, sign-up, email confirmation, password reset, Google and SSO, styled with your **brand color**. Your app can link to it with `ds.auth.redirectToLogin()`, and people return to the page they came from.

If your app has its own sign-in screens, ask the AI to add the parts you need: Google or SSO buttons, a code field for email confirmation, or "Forgot password?". See the [SDK reference](/docs/developers/sdk/common-uses).

## Password reset

"Forgot password?" emails a link that opens a reset page on your app's address. Links work once, for one hour. Choosing a new password signs the person out on every other device. People who signed up with Google or SSO can use it to add a password.

From **Dashboard → Users**, the key icon emails a reset link to anyone.

## Invites and access requests

In **Dashboard → Users → Invite people**, enter email addresses and pick a role. Invited people get an email with a link to create their account with that address. You can invite up to 50 people a day. Password sign-up for an invitation requires email confirmation; configure email delivery before inviting people to a live app. A verified Google or SSO identity also proves the email address.

On a **private** app, people who sign up without an invite become **access requests**. People who already had an account before you made the app private keep access; block them to remove it. Approve or decline them in **Dashboard → Users**; approved people can sign in once their email is confirmed.

## Managing people

**Dashboard → Users** shows each person's role, status (active, email not confirmed, blocked), sign-in method and last sign-in. From there you can:

- change roles (admins pass every data rule)
- **block** someone, which also signs them out everywhere
- delete an account
- **open the app as them** (the eye icon) to check what they see

When you preview a private app in Draftship, you're signed in as its admin automatically.

## Emails

Confirmation codes, reset links and invites are sent from your app's name. They need email sending set up on your Draftship server (`RESEND_API_KEY` and `EMAIL_FROM`).