# User accounts & sign-in

By default your app is **open to anyone with the link** — no login. When you want to lock it down,
you don't have to build accounts, passwords, or a login page: onvibe does all of that for you.
Just ask your AI, and visitors get a proper sign-in screen before they can use your app.

This is for **the people who use your app** — not your onvibe account. It's completely optional.

## Two ways to restrict an app

- **Open sign-up** — anyone can create an account and sign in. Good for a community app, a tool you
  want people to try, anything where you're happy for strangers to register.
- **Invite-only** — only the email addresses you approve can create an account and sign in. Good
  for something private: a family app, a client portal, an internal tool.

## Turning it on

Just tell your AI what you want, for example:

> *"Make people sign in to use this app."*  (open sign-up)

> *"Only let these emails in: ana@example.com, luis@example.com."*  (invite-only)

> *"Make this app public again."*  (turn it off)

You can switch between these at any time.

## What your visitors see

When an app requires sign-in, anyone who opens it first gets a **sign-in / create-account page**.
Once they're in, they use the app normally, and they stay signed in for a while so they don't have
to log in on every visit. There's a sign-out option too.

You don't design or build any of this — onvibe serves the login page and remembers who's who.

## Why it's worth using

- **You don't reinvent login.** No password handling, no security foot-guns — it's handled for you,
  properly (passwords are stored safely, never in your app's code).
- **It saves resources.** Visitors who aren't signed in never even reach your app, so bots and
  random traffic don't wake it up or use up its capacity — only real, signed-in people do.
- **Your app knows who's using it.** Your app can greet people by their email and keep each
  person's data separate (their own notes, orders, posts…). Ask your AI to *"show the logged-in
  person's name"* or *"only show each user their own items."*

## Managing who's in

Ask your AI things like:

> *"Who's signed up to my app?"*

> *"Remove the account for someone@example.com."*

> *"Add maria@example.com to the allowed list."* / *"Remove her from it."*

Removing someone from the allowed list stops them signing in again; removing their account also
signs them out right away.

## Good to know

- **It's per app.** Each app has its own set of users — signing in to one doesn't sign you in to
  another.
- **Scheduled tasks still run.** If your app has a timer/cron job, it keeps working even with
  sign-in turned on.
- **Paused or unpaid apps** show their usual page instead of a login screen — the sign-in gate
  only applies while the app is actually live.
- This is different from writing your own custom login inside the app. For the common case
  (people just need an account to sign in), let onvibe handle it — it's simpler and safer.