Authentication

Authentication gives your app users signup, sign-in, refresh, logout, and optional email verification. Use it for memberships, customer accounts, and gated apps.

This feature is per project. Configure it under Project settings → Authentication.

What Authentication does

• Creates end-user accounts with email and password
• Issues access tokens and refresh tokens
• Tracks backend sessions you can revoke
• Supports optional email verification
• Issues end-user API keys (uak_…) for your own app APIs

What Authentication does not do

Authentication tokens identify the user. They do not open CMS content routes, asset routes, or admin routes.

For CMS reads and writes, use a project API token on your server. The usual pattern is:

1. Authenticate the user in the browser.
2. Send the request to your app server (BFF).
3. Verify the user with GET /api/auth/me or trusted session data.
4. Call the Content API with a project API token from the server.

Where to start

Templates

These starters show working Authentication flows:

• Northline Academy — membership login
• Sable Goods — storefront accounts
• Basic Starters — Next.js, Nuxt, and Astro reference apps

Related docs

• API Access — project Sanctum tokens for CMS routes
• Upgrading to 4.0 — auth breaking changes
• Webhooks — auth events such as signup and login