User accounts & sign-in

By default your app is open to anyone with the link — no login. When you want to lock it down,
you don't have to build accounts, passwords, or a login page: onvibe does all of that for you.
Just ask your AI, and visitors get a proper sign-in screen before they can use your app.

This is for the people who use your app — not your onvibe account. It's completely optional.

Two ways to restrict an app

- Open sign-up — anyone can create an account and sign in. Good for a community app, a tool you
  want people to try, anything where you're happy for strangers to register.
- Invite-only — only the email addresses you approve can create an account and sign in. Good
  for something private: a family app, a client portal, an internal tool.

Turning it on

Just tell your AI what you want, for example:

> *"Make people sign in to use this app."*  (open sign-up)

> *"Only let these emails in: ana@example.com, luis@example.com."*  (invite-only)

> *"Make this app public again."*  (turn it off)

You can switch between these at any time.

What your visitors see

When an app requires sign-in, anyone who opens it first gets a sign-in / create-account page.
Once they're in, they use the app normally, and they stay signed in for a while so they don't have
to log in on every visit. There's a sign-out option too.

You don't design or build any of this — onvibe serves the login page and remembers who's who.

Why it's worth using

- You don't reinvent login. No password handling, no security foot-guns — it's handled for you,
  properly (passwords are stored safely, never in your app's code).
- It saves resources. Visitors who aren't signed in never even reach your app, so bots and
  random traffic don't wake it up or use up its capacity — only real, signed-in people do.
- Your app knows who's using it. Your app can greet people by their email and keep each
  person's data separate (their own notes, orders, posts…). Ask your AI to *"show the logged-in
  person's name"* or *"only show each user their own items."*

Managing who's in

Ask your AI things like:

> *"Who's signed up to my app?"*

> *"Remove the account for someone@example.com."*

> *"Add maria@example.com to the allowed list."* / *"Remove her from it."*

Removing someone from the allowed list stops them signing in again; removing their account also
signs them out right away.

Good to know

- It's per app. Each app has its own set of users — signing in to one doesn't sign you in to
  another.
- Scheduled tasks still run. If your app has a timer/cron job, it keeps working even with
  sign-in turned on.
- Paused or unpaid apps show their usual page instead of a login screen — the sign-in gate
  only applies while the app is actually live.
- This is different from writing your own custom login inside the app. For the common case
  (people just need an account to sign in), let onvibe handle it — it's simpler and safer.