Guests

A guest is a real user with no email or password yet. They get an id, a session and their own data. Use guests to let people try the app, fill a cart or save a draft, and ask them to create an account only when they have a reason to.

In Studio

Users & auth → Sign-in → Sign-in & registration → Ways to sign in → Guest sign-in. Let someone start with no details and become a real account later. A guest nobody has used for 30 days is removed.

Start a guest session

const session = await pawabase.auth.signInAnonymously();
session.user.id;

session = pb.auth.sign_in_anonymously()

Create the guest when the person first does something worth saving, not when the page loads, so visitors who leave immediately don’t create thousands of empty users. Guest creation is rate limited per address. The session is stored like any other: reloading the page keeps the same guest.

Upgrade to an account

When they sign up, attach the email to the same user. Everything the guest created stays theirs.

const { user, verification_sent } = await pawabase.auth.upgradeAnonymous({
  email: "ada@example.com",
  password: "a long passphrase",
  name: "Ada",
  redirectTo: "https://myapp.com/welcome",
});

result = pb.auth.upgrade_anonymous(email="ada@example.com", password="a long passphrase", name="Ada")

If emails must be verified, a link is sent (verification_sent) and the upgrade is complete once they click it. The user.upgraded auth webhook event fires.

Do not call signUp for a guest. It creates a different user, and the guest’s records stay with the old one.

Know if someone is a guest

A guest has no email. Use that to decide what to show:

const user = await pawabase.auth.getUser();
const isGuest = !user.email;

Show “Save your progress: create an account” while isGuest is true.

Limit what guests can do

Guests are real users, so they can do everything a signed-in user can unless your access rules say otherwise. For sensitive actions (inviting others, exporting data, paying) require a confirmed email in the rule: $auth.email is set.

Clean-up

A guest unused for 30 days is removed automatically, together with their sessions. Anything you stored against their id should tolerate that, or be tied to the upgraded account first.

Visitor adds an item: call signInAnonymously() once, then write cart_items with owner_id = user.id.
Visitor checks out: call upgradeAnonymous({ email, password }).
The cart records still belong to the same id. No migration.

Email and password

The account guests upgrade to.

Access rules

Restrict what guests can do.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

In Studio

Start a guest session

Upgrade to an account

Know if someone is a guest

Limit what guests can do

Clean-up

Email and password

Access rules

​In Studio

​Start a guest session

​Upgrade to an account

​Know if someone is a guest

​Limit what guests can do

​Clean-up

​A cart that survives sign-up

Email and password

Access rules

In Studio

Start a guest session

Upgrade to an account

Know if someone is a guest

Limit what guests can do

Clean-up

A cart that survives sign-up