Add website signup and login

Set up Website accounts#

In a project, open Database and choose Website accounts - signup and login, then Create & connect database. On an existing database, select Enable signup & login. Pro permits one database per account; Business permits five. A website needs a published deployment and active hosting to use the API.

Use the ready-made pages#

CloudAuro provides ready-made pages at /__cloudauro/signup and /__cloudauro/login on your website address. Link to these pages from your navigation. These visitor accounts are separate from CloudAuro customer accounts.

Connect your own forms#

To use your own forms, load the SDK on your website:

<script src="/__cloudauro/auth.js"></script>

Then call these methods from your JavaScript after the script loads:

await CloudAuroAuth.signUp({name, email, password});
await CloudAuroAuth.signIn(email, password);
const visitor = await CloudAuroAuth.me();
await CloudAuroAuth.signOut();
await CloudAuroAuth.changePassword(currentPassword, newPassword);
await CloudAuroAuth.deleteAccount(currentPassword);

How sessions work#

The API uses host-only HttpOnly session cookies. No secret keys or write-enabled database tokens belong in the browser. Sessions expire after 12 hours. Passwords require 12-128 characters and are hashed with Argon2id. Accounts are isolated to the website that created them. Built-in pages and API endpoints are only available on the website origin, not the CloudAuro management origin.

Use the REST API directly#

For direct requests, use /__cloudauro/auth/signup, /login, /logout, /me, or /password under that same auth prefix. Mutations use JSON and X-CloudAuro-Auth: 1. Browser Origin must equal your website origin. GET /me returns the signed-in visitor; DELETE /me requires currentPassword. See the OpenAPI document for request fields.

Manage your visitors#

Each database supports up to 1,000 visitor accounts, counted toward storage. View registered visitors in the Database tab; you can delete an account and revoke its sessions. Disable website accounts to stop signups/logins and sign everyone out while preserving account records.

Current limitations#

Limitations: visitor email addresses are self-reported, without email verification. Forgotten-password recovery is not implemented for visitors. Signed-in visitors can change their password. Static HTML/CSS/JS stays public: a login screen does not make uploaded pages private. Visitor authentication does not grant access to managed data-table APIs or provide per-user row permissions. Business tenant snapshots do not include visitor credentials; operator full-database backups are needed to restore these accounts.