> ## Documentation Index
> Fetch the complete documentation index at: https://developers.zite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Internal apps sign in your team automatically; external apps add public sign-in. User sync links a signed-in user to a row in your database.

How users sign in to an app is determined by its **access mode**.

## Access modes

<CardGroup cols={2}>
  <Card title="Internal" icon="building">
    Only members of your Zite organization can access the app. They're signed in automatically, so there's
    no sign-in screen, and `context.user` is always populated. The default for new apps.
  </Card>

  <Card title="External" icon="globe">
    Anyone can access the app. Users sign in through a Zite-hosted page. The auth SDK is available but
    optional: a public marketing page needs no sign-in, a customer portal does.
  </Card>
</CardGroup>

Changing access mode is a deliberate, confirmed action. An agent will ask before switching an app between
internal and external.

## Signing in

On the frontend, use `useAuth` from `zitejs/auth`:

```tsx theme={"system"}
import { useAuth } from 'zitejs/auth';

function Header() {
  const { user, isLoading, loginWithRedirect, logout } = useAuth();
  if (isLoading) return null;
  return user
    ? <button onClick={() => logout()}>Sign out {user.email}</button>
    : <button onClick={() => loginWithRedirect()}>Sign in</button>;
}
```

In backend [workflows](/concepts/workflows), set `authenticated: true` and read `context.user`.
See the [auth reference](/framework/auth) for the full API.

## Sign-in methods

External apps can offer **email magic link**, **Google sign-in**, and **SSO**. You also control signups:
open, disabled, or restricted to specific email domains. Some options depend on your plan:

| Setting | Requires |
| - | - |
| SSO sign-in | Enterprise plan |
| Custom auth email sender & branding | Business plan |
| Sign-in screen customization | Business plan |

These are configured per app (in `zite.config.json` under `authentication`); an agent sets them up for you.

## User sync

**User sync** links a signed-in user to a row in your workspace's database, typically a `Users` table.
Once enabled, the record's fields are merged into `context.user`, so you can read app-specific profile
data (role, team, plan) alongside the user's identity.

<Note>
  User sync is now based on the **workspace database**. Syncing users from Airtable, and the older
  internal-app user sync, are deprecated in favor of a users table in the workspace's own database.
</Note>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.