> ## Documentation Index
> Fetch the complete documentation index at: https://developers.zite.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> Internal apps sign in your team automatically; external apps add public sign-in. User sync links a signed-in user to a row in your database.

How users sign in to an app is determined by its **access mode**.

## Access modes

<CardGroup cols={2}>
  <Card title="Internal" icon="building">
    Only members of your Zite organization can access the app. They're signed in automatically — there's
    no sign-in screen, and `context.user` is always populated. The default for new apps.
  </Card>

  <Card title="External" icon="globe">
    Anyone can access the app. Users sign in through a Zite-hosted page. The auth SDK is available but
    optional — a public marketing page needs no sign-in; a customer portal does.
  </Card>
</CardGroup>

Changing access mode is a deliberate, confirmed action — an agent will ask before switching an app between
internal and external.

## Signing in

On the frontend, use `useAuth` from `zitejs/auth`:

```tsx theme={null}
import { useAuth } from 'zitejs/auth';

function Header() {
  const { user, isLoading, loginWithRedirect, logout } = useAuth();
  if (isLoading) return null;
  return user
    ? <button onClick={() => logout()}>Sign out {user.email}</button>
    : <button onClick={() => loginWithRedirect()}>Sign in</button>;
}
```

In backend [workflows](/concepts/workflows), set `authenticated: true` and read `context.user`.
See the [auth reference](/framework/auth) for the full API.

## Sign-in methods

External apps can offer **email magic link**, **Google sign-in**, and **SSO**. You also control signups —
open, disabled, or restricted to specific email domains. Some options depend on your plan:

| Setting                             | Requires        |
| ----------------------------------- | --------------- |
| SSO sign-in                         | Enterprise plan |
| Custom auth email sender & branding | Business plan   |
| Sign-in screen customization        | Business plan   |

These are configured per app (in `zite.config.json` under `authentication`); an agent sets them up for you.

## User sync

**User sync** links a signed-in user to a row in your workspace's database — typically a `Users` table.
Once enabled, the record's fields are merged into `context.user`, so you can:

* Read app-specific profile data (role, team, plan) alongside the user's identity.
* Reference those fields in row-level [permission](/concepts/permissions) filters via `userField`.

<Note>
  User sync is now based on the **workspace database**. Syncing users from Airtable, and the older
  internal-app user sync, are deprecated in favor of a users table in the workspace's own database.
</Note>