Accounts
Sign-in providers, email and password, and what customers can do in their account.
Everyone signs in the same way, customers and team alike. Anyone can create an account on your store. Only people you give a role can open /admin. See Dashboard.
Sign-in Providers
Set these up under Settings > OAuth. Each provider needs your site address followed by /api/auth/callback/<provider> as a redirect in its console:
| Provider | Redirect | Where to get the keys |
|---|---|---|
| Discord | /api/auth/callback/discord | Discord Developer Portal |
/api/auth/callback/google | Google Cloud Console | |
| Apple | /api/auth/callback/apple | Apple Developer |
| GitHub | /api/auth/callback/github | GitHub Developer Settings |
Discord is required, since it identifies the owner on your license. Leave any other provider blank to turn it off.
Customers can connect several providers to one account from Security, and sign in with any of them.
Email and Password
Turn on Enable Email & Password to show an email form on the sign-in page.
With Send New Customer Email on, new accounts must click a link in their inbox before they can sign in, and Forgot password? emails a reset link. Both need a working SMTP server under Settings > General > SMTP. Without SMTP, email and password sign-in stays off while verification is on.
Email Changes
Allow Email Changes is off by default.
| SMTP | What happens |
|---|---|
| Set up | The customer asks for a new email and approves it from a link sent to their current inbox. |
| Not set up | The email changes straight away and is marked unverified. |
An unverified email is never used to match someone to a team member, so changing an email cannot be used to take over a staff account.
Customer Account
Customers manage their account at /account:
| Tab | What it has |
|---|---|
| Account Details | Name, profile picture, email and points balance. |
| Security | Password, connected providers, signed-in devices and account deletion. |
| My Licenses | Every license with its key, status, seats, expiry, addons and download buttons. |
Signing out other devices, changing the password or disabling a user ends their sessions. The owner account cannot be deleted.
Users
Every account appears under Users in the dashboard, with its email, Discord ID, role, points and when it was last seen. A user with no role and no extra permissions is a customer.