Admin Quickstart
1. Create an Admin Account
Open the admin dashboard and create your first account.
- The first admin to sign up automatically becomes superadmin
- Subsequent signups are regular admins until a superadmin promotes them
2. Create a Project
From the dashboard, click "New Project" and fill in:
| Field | Description |
|---|---|
| Name | Human-readable project name |
| Product Type | web, app, extension, api, or other |
| Domain | Primary domain of your product |
After creation, the dashboard shows the project's API key pair:
- Public Key (
pk_...) — Identifies the project to the API - Secret Key — Shown once; stored as a hash. Copy it immediately.
3. Configure Auth Methods
In the project's Auth Methods section, you can toggle:
- Email/Password — Standard signup/login
- Email Verification — Require users to verify their email
- Password Reset — Allow users to reset passwords
- Magic Link — Passwordless sign-in via email
- TOTP 2FA — Two-factor authentication with authenticator apps
Security Policies
Configure per-project:
| Setting | Default | Description |
|---|---|---|
| Password Minimum Length | 10 | Minimum password character count |
| Allowed Origins | [] | CORS origins (empty = unrestricted) |
| Blocklisted Domains | [] | Email domains rejected at signup |
| Whitelisted Domains | [] | Email domains exclusively allowed |
| Blocklisted Usernames | [] | Usernames/emails rejected at signup |
| Lockout Enabled | true | Account lockout on failed attempts |
| Lockout Max Attempts | 5 | Failed attempts before lock |
| Lockout Window (min) | 15 | Lockout duration |
Redirect URLs
Configure where users are redirected after email actions:
- Login URL — Post-magic-link redirect
- Email Verified URL — Post-verification redirect
- Password Reset URL — Where users set a new password
4. Create Custom User Fields
In the User Fields section, define additional fields to collect at signup:
| Field | Description |
|---|---|
| Name | Internal field name (e.g., company_name) |
| Label | Display label (e.g., "Company Name") |
| Type | text, number, boolean, or date |
| Required | Whether the field is mandatory |
| Default Value | Default when not provided |
| Sort Order | Display order in forms |
5. Configure Webhooks
In the Webhooks section, create endpoints that receive auth events:
Available events:
| Event | When It Fires |
|---|---|
user.signup | New user registered |
user.login | User logged in |
user.login_failed | Login attempt failed |
user.locked | Account was locked |
user.unlocked | Account was unlocked |
user.suspended | User was suspended |
user.reactivated | User was reactivated |
user.email_verified | Email was verified |
user.password_reset | Password was reset |
user.totp_enabled | TOTP was enabled |
user.totp_disabled | TOTP was disabled |
session.created | New session created |
session.revoked | Session was revoked |
6. Customize Email Templates
In the Email Templates section, customize the look and feel of auth emails:
| Purpose | Description |
|---|---|
email_verification | Email verification message |
password_reset | Password reset message |
magic_link | Magic sign-in link message |
force_password_reset | Admin-forced password reset |
Templates use {{variable}} placeholders:
{{project_name}}— Project display name{{action_url}}— The action link URL{{expires_in}}— Token expiration time{{preheader}}— Email preheader text
7. Review Audit Logs
The Audit Logs section shows a chronological event stream for each project. Each entry includes the actor, event type, timestamp, and metadata.
8. Superadmin Actions
Superadmins can:
- View all projects across the platform
- View all users across all projects
- Suspend/reactivate any project or user
- Unlock locked user accounts
- Reset user TOTP
- Force password reset for any user
- Set platform-wide default email templates