# Accounts

URL: https://zerodev.ca/docs/prism/accounts

> Sign-in providers, email and password, and what customers can do in their account.



Everyone signs in the same way, customers and team alike. Anyone can create an account on your store. Only people you give a role can open `/admin`. See [Dashboard](/docs/prism/dashboard#signing-in).

## Sign-in Providers

Set these up under **Settings > OAuth**. Each provider needs your site address followed by `/api/auth/callback/<provider>` as a redirect in its console:

| Provider | Redirect                     | Where to get the keys                                                                       |
| -------- | ---------------------------- | ------------------------------------------------------------------------------------------- |
| Discord  | `/api/auth/callback/discord` | [Discord Developer Portal](https://discord.com/developers/applications)                     |
| Google   | `/api/auth/callback/google`  | [Google Cloud Console](https://console.cloud.google.com/apis/credentials)                   |
| Apple    | `/api/auth/callback/apple`   | [Apple Developer](https://developer.apple.com/account/resources/identifiers/list/serviceId) |
| GitHub   | `/api/auth/callback/github`  | [GitHub Developer Settings](https://github.com/settings/developers)                         |

Discord is required, since it identifies the owner on your license. Leave any other provider blank to turn it off.

Customers can connect several providers to one account from **Security**, and sign in with any of them.

## Email and Password

Turn on **Enable Email & Password** to show an email form on the sign-in page.

With **Send New Customer Email** on, new accounts must click a link in their inbox before they can sign in, and &#x2A;*Forgot password?** emails a reset link. Both need a working SMTP server under **Settings > General > SMTP**. Without SMTP, email and password sign-in stays off while verification is on.

## Email Changes

**Allow Email Changes** is off by default.

| SMTP       | What happens                                                                               |
| ---------- | ------------------------------------------------------------------------------------------ |
| Set up     | The customer asks for a new email and approves it from a link sent to their current inbox. |
| Not set up | The email changes straight away and is marked unverified.                                  |

An unverified email is never used to match someone to a team member, so changing an email cannot be used to take over a staff account.

## Customer Account

Customers manage their account at `/account`:

| Tab             | What it has                                                                     |
| --------------- | ------------------------------------------------------------------------------- |
| Account Details | Name, profile picture, email and points balance.                                |
| Security        | Password, connected providers, signed-in devices and account deletion.          |
| My Licenses     | Every license with its key, status, seats, expiry, addons and download buttons. |

Signing out other devices, changing the password or disabling a user ends their sessions. The owner account cannot be deleted.

## Users

Every account appears under **Users** in the dashboard, with its email, Discord ID, role, points and when it was last seen. A user with no role and no extra permissions is a customer.