Apps generated on Forge64 ship with email and password sign-in, sessions, and per-user data scoped in the app's own Postgres database. Status: available.
What you get
- Email and password sign-in and sessions in every generated app.
- Each user's records are scoped to that user in your app's own database, not in a database shared with other apps.
- One-click Google and GitHub sign-in through Forge64's shared sign-in broker, so you do not have to register your own OAuth apps. Codes are single-use, expire in 60 seconds and are bound to your app. Status: rolling out.
What it costs
Your app's users are not billed. No plan has a per-user or per-monthly-active-user charge, so the sign-in bill does not grow as your app does.
Managing your app users (rolling out)
Each project has a Users page (Project, then Users) backed by a user-management API. From it you can:
- Search your app's users and filter to banned accounts.
- Ban a user, with an optional reason and end date, and unban them.
- Sign a user out everywhere: every session they have open is revoked.
- Reset two-factor: removes their authenticator app and recovery codes and signs them out, so they can enrol again.
- Change a user's role (paid plans).
- Delete a user and their sign-in data. You confirm by typing the user's email address.
Every one of these actions is written to the audit log with the user's id, never their email or a token. Authenticator-app two-factor for your app's users is rolling out on the Pro plan and above.
Coming soon
- Coming soon: passkeys for your app's users.
Until those ship, do not promise your customers anything listed above.
Test it before you launch
Sign in as two different users and try to open each other's records by changing the id in the address. Both attempts should be refused.