Auth - Anything

Anything: Setting up User Logins and Accounts

User Accounts let people sign up, sign in, and stay logged in to your app. Ask the agent and it handles the rest, from login pages to storing users in your database. Use User Accounts to:

Getting started

Say something like “add sign up and login” or “let users create accounts.” Anything will:

  1. Enable User Accounts in your project
  2. Add sign up, sign in, and logout pages
  3. Create auth tables in your database to store users
  4. Add checks to your pages and functions so only logged-in users can access protected content

You’ll know it’s working when you see the auth pages in the Project Selector and the auth tables in your database viewer.

Finding the sign up, sign in and log out pages in Project Selector. Checking the auth tables in the database.

Auth pages

Anything creates three pages:

You can customize how they look. Say “add a logo to the sign in page” or “make the auth pages match my brand.” You can also create sign-in and sign-up components to embed anywhere in your app.

Auth tables

Anything creates four tables in your database:

Table What it stores
auth_users User profiles (email, name, image)
auth_accounts Login methods per user (email/password, Google, etc.)
auth_sessions Active sessions
auth_verification_token Email verification and magic link tokens

You don’t need to manage these directly. Anything handles it. But knowing the structure helps if you’re debugging or building advanced features.

Protected pages

Tell Anything which pages require sign-in and which are public. If someone visits a protected page without being logged in, Anything redirects them to sign in and sends them back after.

Only signed-in users should see the dashboard. Keep the landing page public.

How sessions work

When someone signs up or signs in, Anything stores a secure cookie in their browser. That cookie keeps them logged in as they browse your app.

Passwords are hashed with bcrypt. Sessions use JWT tokens.

Example

Say you have a landing page at / and an AI homework creator at /app.

  1. Say “add sign up and login, only signed-in users can use the homework creator”
  2. Or protect manually: go to the /app page, open the 3-dot menu > Settings > “Require account to view”
  3. Publish

Now / stays public, /app redirects to sign-in, and after login users land on /app. From there:

When the user is logged in, show their profile in the top right and store their AI generations

If this is the user's first time, show them an onboarding flow

Customizing auth pages

Add a logo to the sign in page

Make the sign in and sign up pages match the rest of my app

Add a terms of service checkbox to sign up

If you add extra fields to sign up (like name or phone number), make sure they’re optional in the database. Only email and password should be required for sign up to work. You can collect additional info after the user creates their account.

Flows and redirects

Tell Anything where to send users after sign up, sign in, and logout.

After sign up, send users to the dashboard. After logout, send them to the homepage.

Anything handles the full flow automatically: form validation, storing the account, setting the session cookie, and redirecting.

User data

By default, Anything stores email, a hashed password, user ID, and created date. You can add anything else:

Add a bio field to user profiles

Store user preferences like theme and notification settings

Let users upload a profile picture

Anything adds the fields to your database, updates the queries, and wires up the UI.

Using user data

Reference user data in your prompts and Anything updates your pages and functions to use it.

Show the logged-in user's tasks in the main feed

If the user is logged in, show a profile image in the top right. Otherwise show sign up and sign in buttons.

You can also view and edit user data from the Database Viewer.

Roles and permissions

Add roles to control who can do what. Describe the roles you want and how behavior should change:

Add an admin role. If the signed-in user is admin, show the settings page. Otherwise hide it.

Auth methods

Anything supports five sign-in methods. Toggle them on or off in Project Settings.

Method Setup Guide
Email/Password None, enabled by default. Passwords hashed with bcrypt.
Google Requires a Google Client ID and Secret Guide
Apple Coming soon
Facebook Requires a Facebook App ID and Secret Guide
X (Twitter) Requires an X Client ID and Secret Guide

Anything also supports magic links for passwordless sign-in. Ask the agent to “add magic link login” and it sets up email-based sign-in with no password required.

Testing

  1. Publish your changes
  2. Open an incognito window
  3. Visit a protected page and confirm it redirects to sign-in
  4. Create a test account and confirm you can access the page

Troubleshooting

If auth isn’t working:

Error codes

If someone hits an error during sign in or sign up, check the URL for ?error=[code].

Common error codes and fixes: