Let your users sign in

Every app on Appbricx comes with sign-in for its users, ready on day one. People can create an account with an email and password, sign in with Google in one click, protect their account with a second factor, and join their team's organisation from an invite. You decide who may sign up. You write no auth code and store no passwords yourself.

What your users can do

Your app's sign-in screen shows only the methods that are switched on. What each signed-in user can then see and change is set by their role: see Give each user the right access.

Sign in with Google, one switch

Your app can use Appbricx's own Google sign-in. There is no Google Cloud project to create, no consent screen to configure and no client secret to manage. Turn it on in any of three ways:

• In the contract. Set google in the auth section, or ask your agent to. It takes effect on the next apply; false turns it off.

  "auth": { "google": true }

• From your agent or scripts: the MCP tool sign_in_providers with { "provider": "google", "enabled": true }, or POST /api/dev/v1/projects/:id/sign-in on the dev HTTP API with the same body.
• In Project settings → Sign-in, by switching Google on.

A "Continue with Google" button then appears on your app's sign-in screen. Google's consent screen shows Appbricx as the app asking for access. When you want your own name there, bring your own Google client.

Bring your own Google client

1. In Google Cloud, create an OAuth client of type "Web application".
2. Add this authorised redirect URI, with your app's host:

   https://<your-app-host>/__appbricx/auth/oauth/google/callback

   Add one for each host your users sign in on (your apps.appbricx.com link and each custom domain).
3. Paste the client ID and client secret into Project settings → Sign-in, which also shows the exact redirect URI to copy. The secret is encrypted at rest.

GitHub works the same way with your own GitHub OAuth app and the callback https://<your-app-host>/__appbricx/auth/oauth/github/callback.

On your own sign-in screen

A custom sign-in screen gets the switched-on providers and a way to start one:

{app.auth.providers.map((p) => (
  <button key={p.name} onClick={() => app.auth.startProvider(p.name)}>
    Continue with {p.label}
  </button>
))}

In app code you own, use usePlatformSession().startProvider("google") (see the SDK).

Two-factor codes

Users can add an authenticator app (Google Authenticator, 1Password, Authy and others) to their account. After their password they enter a six-digit code. When they turn it on they get a set of single-use backup codes, so losing a phone does not lock them out.

Organisations and invites

For B2B apps, users belong to organisations. An admin invites colleagues by email to join their organisation. Admins can also manage users directly: list accounts, change a role, disable an account. The multi-tenant SaaS walkthrough builds one end to end.

Who may sign up

Set it in the editor under Backend → Auth (Sign-up and roles). Development and production keep their own setting. The policy applies to every method, including Google and GitHub, and the sign-in screen hides the sign-up form when sign-up is not open.

Reference

• Sign-in routes live under /__appbricx/auth/*on your app's host (signup, login, logout, me, reset).
• GET /__appbricx/auth/oauth/providers lists the providers that are switched on.
• Sessions use an HttpOnly cookie on your app's own host, so tokens are not exposed to page scripts.
• verify signs in as every role on every release (see How every release is checked).

Related: Access per user · Custom sign-in screen · Frontend SDK