Guides

Auth

Add app-user auth, roles, invites, and sessions.

For agents: Declare auth.mode: "app_users" and roles, then call ctx.auth.currentUser(request) or ctx.auth.requireRole(request, role).

Reserved Routes

App-user signup, login, logout, session lookup, and invite acceptance live under /_userland/auth/*.

Platform vs App Users

Platform account members use the CLI/API to publish releases and operate apps. App users sign in only to a published app origin and are authorized by the app roles declared in manifest.userland.json.

Create admin invites through the control-plane API after publishing an app that declares the target roles:

POST /v0/apps/:app_id/admin-invites

The invite creates an app user for that app. It does not add a platform account member or grant CLI/API access.