Sign-up restrictions

Restrictions control who can get in. They apply to every route into the app: password, sign-in link, code and social sign-in.

Restrictions page — Users & auth → Restrictions: sign-up and email domains.

In Studio

Users & auth → Security → Restrictions. Whether strangers can create an account, and what they get when they do.

Setting	Meaning	Key
Allow sign-ups	Off makes the environment invitation-only: only operators create accounts	`signup_enabled`
Require a verified email	Unverified people cannot sign in until they confirm their address	`require_email_verification`
Roles for new accounts	Granted automatically at sign-up	`default_roles`

Email domains

Limit sign-ups to the companies you work with, or turn away throwaway mailboxes.

Setting	Meaning	Key
Only allow these domains	Leave empty to allow any domain	`allowed_email_domains`
Always block these domains	A blocked domain is refused even when the allow list is empty	`blocked_email_domains`
Try an address	Checks the rules above, including changes you haven’t saved yet	none

Use Try an address before saving: type someone@gmail.com and see whether it would be let in.

What your app sees

A refused sign-up throws an error you can show:

try {
  await pawabase.auth.signUp({ email, password });
} catch (e) {
  if (e instanceof ValidationError) setMessage(e.fieldError("email") ?? "We can't create that account.");
  else if (e instanceof PermissionError) setMessage("Sign-ups are closed. Ask for an invitation.");
  else throw e;
}

Read (await pawabase.auth.settings()).signup_enabled to hide the “Create account” button when sign-ups are off.

Common setups

Goal	Settings
Public app, real addresses only	Verified email on, block disposable domains
Company tool	Sign-ups on, allow only the company’s domain, `default_roles: ["member"]`
Invite-only beta	Sign-ups off; create people or invite them
Customers bring their own login	Sign-ups off; company sign-in with the customer’s domain

Good to know

Allowed domains are compared to the part after @. Subdomains are different domains.
Existing accounts keep working when you tighten a rule. To remove someone, disable or delete them in Users.
default_roles apply at sign-up only. Change an existing person’s roles in Users .

Invitations

Bring people in when sign-ups are off.

Roles

What default roles mean.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

Sign-up restrictions

In Studio

Email domains

What your app sees

Common setups

Good to know

Invitations

Roles

​In Studio

​Sign-up

​Email domains

​What your app sees

​Common setups

​Good to know

Invitations

Roles

In Studio

Sign-up

Email domains

What your app sees

Common setups

Good to know