Skip to main content
How users sign in to an app is determined by its access mode.

Access modes

Internal

Only members of your Zite organization can access the app. They’re signed in automatically — there’s no sign-in screen, and context.user is always populated. The default for new apps.

External

Anyone can access the app. Users sign in through a Zite-hosted page. The auth SDK is available but optional — a public marketing page needs no sign-in; a customer portal does.
Changing access mode is a deliberate, confirmed action — an agent will ask before switching an app between internal and external.

Signing in

On the frontend, use useAuth from zitejs/auth:
In backend workflows, set authenticated: true and read context.user. See the auth reference for the full API.

Sign-in methods

External apps can offer email magic link, Google sign-in, and SSO. You also control signups — open, disabled, or restricted to specific email domains. Some options depend on your plan: These are configured per app (in zite.config.json under authentication); an agent sets them up for you.

User sync

User sync links a signed-in user to a row in your workspace’s database — typically a Users table. Once enabled, the record’s fields are merged into context.user, so you can:
  • Read app-specific profile data (role, team, plan) alongside the user’s identity.
  • Reference those fields in row-level permission filters via userField.
User sync is now based on the workspace database. Syncing users from Airtable, and the older internal-app user sync, are deprecated in favor of a users table in the workspace’s own database.