New in 4.0

Authentication for members, accounts, and gated apps

Elmapi gives signup, sign-in, refresh, logout, and optional email verification for your app users.

Signup, sign-in, refresh, logoutEmail verification and session controlsReady templates for Next.js, Nuxt, and Astro
Auth lifecyclesignup → session → refresh → logout
01

Sign up or sign in

Your app calls the auth endpoints with email and password.

02

Hold the session

Store the access token and refresh token in your app session layer.

03

Refresh when needed

When the access token expires, refresh it without a full sign-in.

04

Sign out

Revoke the backend session and clear local auth state.

See templates with authRead the docs

Everything you need for app login

Accounts, tokens, sessions, verification, and keys in one Authentication feature set.

End-user accounts

Email and password login for members, customers, and learners. Built for your frontend apps.

Identity JWTs

Issue short-lived access tokens and refresh tokens for each signed-in user.

Sessions you can revoke

Each sign-in creates a backend session. Sign-out revokes it. Cap concurrent sessions when you need to.

Email verification

Optional verification before sign-in or refresh. Send verification emails from project settings.

User API keys

Issue uak_ keys for your apps. Inspect key status, suspend users, and limit concurrent sessions.

Project settings

Turn verification on or off. Set session limits. Suspend users from the Authentication settings UI.

Sessions and tokens

Keep login state clear and easy to revoke

Each successful sign-in creates a backend session. Your app receives an access token and a refresh token. When the user signs out, Elmapi revokes the session.

  • - Short-lived access tokens for API calls from your app
  • - Refresh tokens for quiet session renewal
  • - Concurrent session limits in project settings
  • - Suspend a user when you must block access
Access token

Short life. Use it while the user is active in your app.

Refresh token

Longer life. Renew access without asking for the password again.

Backend session

The source of truth. Sign-out and suspension act on this session.

APIcommon auth endpoints
POST/auth/registerCreate an account
POST/auth/loginSign in and get tokens
POST/auth/refreshRefresh the access token
POST/auth/logoutRevoke the session
GET/auth/meRead the current user
POST/auth/verify-emailConfirm email when required
API surface

Clear endpoints for every login step

Use the Authentication API from your frontend or BFF. The official JS SDK and template starters show the full flow.

API reference
Use cases

Built for real product logins

Start from a template that already wires Authentication into a working frontend.

Memberships

Gate lessons, plans, or member-only pages after sign-in.

Northline Academy

Storefront accounts

Let customers sign in, check out, and view order history.

Sable Goods

Reference starters

Copy the auth contract into Next.js, Nuxt, or Astro apps.

Basic Starters

Email verification

Confirm accounts when you need it

Turn email verification on in project settings. Users confirm their address before sign-in or refresh, based on your rules.

  • - Optional per project
  • - Self-service signup can send the verification email
  • - Fits membership and account products that need a real inbox
User API keys

Give apps a stable user credential

Issue uak_ keys for integrations and app-side access. Inspect key status. Suspend users when access must stop.

  • - Keys scoped to the end user
  • - Introspection for your server-side checks
  • - Works beside normal signup and session flows

Ready to add login to your app?

Use ElmapiCMS Authentication for signup, sessions, verification, and user API keys. Start from a template or read the docs.

See PricingBrowse auth templatesAPI reference