> ## Documentation Index
> Fetch the complete documentation index at: https://docs.webstorio.com/llms.txt
> Use this file to discover all available pages before exploring further.

# User Authentication

> Let visitors sign in to your site with Sign in with Webstorio — sessions, auth pages, and protected experiences.

**User Authentication** lets visitors create an account on your published site and sign in with **Sign in with Webstorio** — Webstorio's platform OAuth flow. Signed-in users get a **site session** scoped to your project.

Use it for member areas, order history, signed-in-only App Data writes, and personalized pages.

**Available on:** Growth plan and above.

## When to use it

| Use authentication when…                              | Skip it when…                                  |
| ----------------------------------------------------- | ---------------------------------------------- |
| Visitors need accounts (orders, profiles, dashboards) | The site is fully public with no per-user data |
| App Data tables use signed-in read/write presets      | Forms alone are enough for one-way submissions |
| You show **My orders** or account pages               | You only need CMS or marketing pages           |

## How sign-in works

```mermaid theme={"dark"}
sequenceDiagram
  participant Visitor
  participant Site as Your published site
  participant WS as Webstorio OAuth
  participant API as Site auth API

  Visitor->>Site: Click Sign in with Webstorio
  Site->>WS: OAuth authorize
  WS->>Visitor: Sign in / consent
  WS->>API: Callback with code
  API->>Site: Session cookie + redirect
  Visitor->>Site: Signed-in pages
```

Each visitor who signs in becomes a **site user** in your project. You can view and manage them under **Auth → Users** in the dashboard.

## Step 1 — Enable User Authentication

1. Open your **project dashboard**.
2. Go to **Features** and enable **User Authentication**.
3. Open **Auth** in the project sidebar.

## Step 2 — Create auth pages

Webstorio scaffolds default sign-in and account pages.

1. Go to **Auth → Settings**.
2. Click **Create auth pages** (or equivalent scaffold action).
3. Webstorio adds:
   * **Sign-in page** — default path `/auth/sign-in`
   * **Account page** — profile and sign-out for signed-in visitors

Customize layout and copy in the page editor like any other page.

<Tip>
  Ask the AI: *"Style the sign-in page to match my brand colors"* after
  scaffolding.
</Tip>

## Step 3 — Configure auth settings

Under **Auth → Settings**:

| Setting                    | Purpose                                                        |
| -------------------------- | -------------------------------------------------------------- |
| **Sign-in page path**      | Where visitors go to sign in (default `/auth/sign-in`)         |
| **Redirect after sign-in** | Path after successful login (default `/`)                      |
| **Allowed redirect URIs**  | Extra callback URLs — required when using **custom domains**   |
| **Callback URLs**          | OAuth endpoints for your subdomain and verified custom domains |

<Warning>
  After adding a **custom domain**, open Auth settings and confirm callback URLs
  are listed and verified. Add any extra redirect URIs your pages need.
</Warning>

## Step 4 — Manage site users

**Auth → Users** lists everyone who has signed in to your site.

* See email, name, status, and sign-up date
* **Disable** users to block sign-in without deleting history
* **Remove** users when appropriate
* Monitor usage against your plan's **site user limit**

| Plan       | Site users |
| ---------- | ---------- |
| Growth     | 25,000     |
| Pro        | 100,000    |
| Enterprise | Unlimited  |

## Step 5 — Use sessions on your site

The fastest way to wire up sign-in is to ask the AI builder (see the prompts below). Editing page code yourself? Pages manage sessions with `window.webstorio` auth methods — start sign-in with `signInWithWebstorio`, read the visitor with `getSession`, and end the session with `signOut`. On sign-in pages, if `getSession()` already returns a user, redirect them onward instead of showing the button again.

→ Methods, parameters, and examples: [Auth SDK reference](/api-reference/sdk/auth)

## Works with other website features

### Online store

* Checkout can **prefill** customer email from `getSession()`
* Orders link to the signed-in **site user** when authentication is enabled
* **My orders** pages use `getMyOrders()` and `getMyOrderById()`

→ [Online store](/guides/online-store)

### App Data

API presets like **Signed-in users (read only)** or **Public read, signed-in write** require an active site session.

→ [App Data](/guides/app-data)

## Example AI prompts

* *"Add a Sign in button in the header that calls signInWithWebstorio"*
* *"Account page showing the current user's name and email from getSession, with a sign out button"*
* *"Protect this page — redirect to /auth/sign-in if getSession returns null"*
* *"Checkout page that prefills email from getSession when the user is signed in"*

## Tips

<Tip>
  Publish auth pages before linking to them from your header or store checkout.
</Tip>

<Tip>
  Use **disable** instead of delete when you need to block access but keep order
  or submission history tied to a user.
</Tip>

## For developers

Page code uses `window.webstorio` auth methods. → [Auth SDK](/api-reference/sdk/auth)