Add authentication
Add sign-in and user accounts to your app with the AI app builder
Ask PlutoAI to add sign-in and user accounts, and it builds the sign-up, sign-in, and protected pages for your app.
When to use it
Use this when parts of your app should be private, or when each person needs their own data: a members area, a dashboard, an account with saved settings.
What you need
- An account at plutoai.one.
- A place to store users. Where a connected database or service provides auth, the agent uses it. Connecting a database provider first, such as Supabase, gives the agent somewhere to keep user records. See Add a database.
Steps
- Connect a data source (recommended)
Connect a database or service so user accounts have somewhere to live.
- Ask for sign-in
Tell the agent to add sign-up, sign-in, and sign-out to your app.
- Protect the right pages
Say which pages require sign-in and which stay public.
- Confirm your access rules
Have the agent walk you through who can see and change what before you share a live link.
Two things sign-in decides
Adding accounts is really two decisions, and it helps to be explicit about both:
- Who can reach a page. Which pages require sign-in, and which stay public. For example, the dashboard is private but the home and pricing pages are open.
- Who can see which data. Once users share a database, each user should usually only read and edit their own records. This is separate from page access, and it is the part most worth confirming before you go live.
Page access follows a simple rule on every visit:
Example prompt
Add user accounts to my app. Build sign-up, sign-in, and sign-out.
Require sign-in for the dashboard and account pages, keep the home and
pricing pages public, and send signed-in users to the dashboard after
they log in.
Realistic follow-ups:
Add a "forgot password" flow.
Each signed-in user should only see and edit their own records. Confirm
the rules with me before we go live.
Expected result
Visitors can create an account and sign in, protected pages require it, and each user reaches their own view of the app.
Confirm your access rules before sharing a live link. Ask the agent to show which pages and which data are restricted, so private pages are not reachable without signing in and one user cannot read another user's data.
Common problems
- Nowhere to store users. Connect a database or service that provides auth first.
- A page you meant to protect is public, or the reverse. Tell the agent the exact page and the rule it should follow.
- Users can see each other's data. Ask the agent to scope every table to the signed-in user and confirm the rules.