Security & Access

User Login & Access Control

Who should be able to use your app? Should people need to log in? How do you control what different users can do?

This guide helps you describe your login and access control needs to Adaptive—whether you're building something open to everyone, something private, or anything in between.

Three Types of Apps

The first thing to understand is what type of app you're building. Everything else flows from this:

1

Open Apps

No login needed—anyone can use them freely

Examples: Calculator, weather app, informational site, marketing page

2

Partially Protected Apps

Some features are open to everyone, others require login

Examples: Blog where anyone can read but only logged-in users can comment; marketplace where browsing is open but purchasing requires login

3

Fully Protected Apps

Login required for all access

Examples: To-do list, order manager, member portal, internal tools

Adaptive automatically figures out which type your app needs based on what you're building. If you want to change it, just say what you need—for example, "I want users to log in before they can access the app" or "Let anyone browse, but require login to purchase."

How Login Works

If your app is Partially Protected or Fully Protected, users will need to log in. Here's how Adaptive handles it:

The Login Experience

Handled automatically by Adaptive

  • Users see a branded login screen with your app's icon and name
  • They log in securely with email or phone verification
  • They stay logged in across visits
  • No passwords to remember or manage

Access Control

You describe, Adaptive builds

  • Who can use your app (everyone who logs in, invited users only, specific roles)
  • What different users can do (admin vs regular user)
  • User profiles (usernames, avatars, custom info)
  • Invitation systems, onboarding flows, personalized content

Think of it this way: Adaptive handles the "log in with email" part automatically. You just describe who should have access and what they should be able to do.

What You Can and Can't Customize

When building Partially Protected or Fully Protected apps, here's what's fixed and what you control:

What's Fixed

Adaptive Handles This

These parts of the login experience are standard and can't be changed:

  • ×Login is always by email or phone verification (no usernames or passwords)
  • ×The login screen shows your app's icon/name + "Powered by Adaptive"

Why? Just like Stripe handles payments and Shopify handles checkout, Adaptive handles the login system. You get security, reliability, and users staying logged in—without building any of it yourself.

What You Control

Tell Adaptive What You Need

After someone logs in, you control everything about how your app works:

  • Who can use your app: Everyone, invited users only, or based on roles
  • Different permissions: Admins can edit, regular users can only view, etc.
  • User profiles: Usernames, bios, avatars, custom information
  • Welcome experience: Onboarding screens, profile setup, tutorials
  • Multiple apps: Separate apps for different groups (staff vs clients)
  • Privacy: Users only see their own data, or what they're allowed to see

Common Scenarios

Pick the scenario that matches your needs:

→ Open App

Examples: Calculator, weather widget, blog, landing page, public documentation

Prompt
"Build a tip calculator that anyone can use"
Result
Access

Globally accessible URL. No login screen ever shown.

Data

All data is either local (client-side) or shared public data. No user-specific storage.

Experience

Instant access. Zero friction for your users.

→ Partially Protected App

Examples: Blog with comments, marketplace, recipe site where you save favorites

Prompt
"Anyone can browse recipes, but you need to log in to save favorites"
Result
Access

Public read access. Protected write access.

Data

Public content is visible to all. User-specific data (favorites) is linked to the account.

Experience

Users can browse anonymously. Clicking "Save" triggers the login modal. Context is preserved after login.

→ Fully Protected App

Examples: Todo list, expense tracker, personal journal

Prompt
"Build a todo app where each user sees only their own tasks"
Result
Access

Login required immediately upon visiting the site.

Data

Strict isolation. All database queries automatically filter by the logged-in user's ID.

Experience

Users see a branded login screen first. Post-login, they enter their private workspace.

→ Fully Protected App

Examples: Team workspace, client portal, beta product

Prompt
"Only people I invite can access this app"
Result
Access

Restricted to a whitelist of email addresses.

Security

New sign-ups are checked against the invite list. Uninvited users are blocked during registration.

Management

You get an admin interface to add/remove allowed emails.

→ Fully Protected App

Examples: Content management system, order dashboard with managers and staff

Prompt
"Admins can create and delete. Editors can only edit. Viewers can only read."
Result
Structure

Users are assigned roles (ADMIN, EDITOR, VIEWER).

Permissions

API endpoints and UI elements check the user's role before allowing actions.

Security

Backend validation ensures users cannot perform actions outside their role's scope.

→ Multiple Apps

Examples: Internal staff app + external client portal that share data

Prompt
"I have a staff app (@ordermanager). Build a separate client portal where clients submit orders that appear in @ordermanager. Clients see only their orders."
Result
Architecture

Two distinct frontends sharing a backend/database.

Identity

Single Sign-On (SSO) experience. Users have one account but different permissions per app.

Data Flow

Client app creates records; Staff app views/processes them. Contexts are kept separate.

→ Fully Protected App

Examples: Social app, community forum, any app where users have public identities

Prompt
"After login, users choose a username. Show usernames next to their posts."
Result
Flow

Login → Onboarding (Profile Creation) → App Access.

Data

A public Profile record is created and linked to the private User auth record.

Visibility

Auth details (email/phone) remain private; Profile details (username/avatar) are public.

Frequently Asked Questions

Yes! Authentication is completely optional. Your app can be:

  • Open: No login needed—anyone can use it
  • Partially Protected: Some features are open, others require login
  • Fully Protected: Login required for all access

Just tell Adaptive which type you need or which parts require login. See "Three Types of Apps" above for details.

Username/password login is not supported. The platform uses email/phone verification for security. However, you can achieve a similar experience with a different approach:

  1. Users log in securely with email/phone verification
  2. You prompt them to create a username during onboarding
  3. Throughout your app, they're known by their username

You get secure login + your custom user experience. See "Custom User Profiles" in the scenarios above for details.

Key concept: The same person has separate user records in different apps, but the platform knows they're the same person.

How it works:

  • Users have one login across all Adaptive apps (single account)
  • Each app maintains its own user records and data for privacy
  • The platform automatically knows when it's the same person across apps
  • When one app communicates with another app on behalf of a user, the mapping happens automatically

Why this matters:

  • Privacy & isolation: Each app only sees its own user data
  • Seamless integration: Apps can work together on behalf of the same user
  • Simple to build: You don't need to manage user IDs across apps—the platform handles it

Example: You build a staff app and a client portal. When Sarah logs into both:

  • She uses the same login (email/phone) for both apps
  • Each app has its own record for her (different IDs internally)
  • When the client portal submits an order to the staff app on Sarah's behalf, the platform automatically knows it's her
  • Both apps can work together while keeping their data separate

Yes! Adaptive can build access restrictions for you. You can request:

  • Invite-only access (only people you invite can use the app)
  • Role-based access (some users are ADMIN, others are VIEWER)
  • "Access Required" screens for non-approved users
  • Email invitation system to pre-register specific people

See "Invite-Only Access" and "Role-Based Access" in the scenarios above for examples.

Adaptive can build complex permission systems for you. You can request:

  • Feature-specific permissions (e.g., "can edit articles but not delete")
  • Time-based access (e.g., "trial expires after 14 days")
  • Subscription tiers (e.g., "free users see 10 items, paid users see unlimited")
  • Resource-based permissions (e.g., "users can only edit their own posts")
  • Team-based access (e.g., "managers can approve requests from their team only")

Just tell Adaptive what you need in plain language. After users log in, Adaptive builds whatever permission logic your app requires.

Yes! The platform uses industry-standard security practices:

  • Encrypted connections (HTTPS)
  • Secure token storage and session management
  • Email/phone verification (no passwords to store or compromise)
  • Regular security audits
  • Isolated user data per app for privacy

Just like Stripe handles payment security, Adaptive handles login security—so you don't have to.

Getting Started

Now that you understand the three types of apps and how login works, here's how to build what you need:

Step 1: Decide which type of app you're building

Think about who should be able to use your app:

  • Open App: Anyone can use it, no login needed
  • Partially Protected: Some features are open, others require login
  • Fully Protected: Login required to access anything

Adaptive will figure this out automatically, but you can explicitly tell it what you need.

Step 2: Describe your access control needs

Use plain language to describe who should have access and what they can do:

Personal dashboard:

"Each user sees only their own data"

Invite-only:

"Only people I invite should have access"

Role-based:

"Admins can edit everything, regular users can only view"

Step 3: Adaptive builds it

Adaptive handles the login system automatically and builds the access control you described:

  • Login screens with email/phone verification
  • Access lists and invitation systems
  • Role-based permissions

Remember: Start with which type of app you're building, then describe who can access it and what they can do.

    Adaptive