# Auth & user accounts

> Manage the people who sign up on your site — user list, social logins (Google, GitHub, and more), and the emails your site sends.

Source: https://support.estage.com/cloud-auth
Part of the ESTAGE Support help center (https://support.estage.com). Full knowledge base: https://support.estage.com/llms-full.txt

---

When your site has accounts, the **Auth** tab is where you manage the people who sign up —
and the **Email** tab controls the emails your site sends them.

## Your users

The user list shows everyone who has registered on your site: email, status
(confirmed/pending), how they signed in (password or which social provider), and their last
sign-in date.

- **Add user** — create an account manually (email + password). Handy for test accounts or
  setting someone up yourself.
- **Delete** — remove an account permanently (confirmation required).
- **Refresh** — reload the list.

## Sign-in providers (social login)

Email + password and **magic links** (passwordless email sign-in) work out of the box. On top
of that you can enable **social logins** — Google, GitHub, Facebook, Apple, Microsoft Azure,
Discord, Twitter/X, LinkedIn, GitLab, Spotify, Slack, Notion.

Each provider needs a one-time setup:

1. Expand the provider and **copy the Callback URL** shown.
2. In that provider's developer console (e.g. Google Cloud Console), register an OAuth app
   with that callback URL — you'll get a **Client ID** and **Client Secret**.
3. Paste both into Genesis and click **Enable**.

The provider shows **Enabled**, and your site's sign-in UI can offer that login. Use
**Edit** / **Disable** on the provider any time.

> **Tip**
>
> Only set up the providers your audience actually uses — one or two well-chosen options
> convert better than a wall of buttons.

## Sign-in on your own domain (custom callback address)

Out of the box your backend's sign-in lives on a technical address (`<id>.supabase.co`).
That address is what Google shows on its sign-in screen ("continue to …"), what every
provider's **Callback URL** points at, and where sign-in emails link. You can move all of it
to a subdomain you own, like `auth.yoursite.com`. Only the project owner can do this.

It lives in **Settings → Cloud & Publishing → Dedicated Cloud → Auth**, in the providers card,
right under the **Callback URL**.

1. Click **Use auth.yoursite.com** — Genesis offers it when a domain is connected to the
   project. To pick another subdomain, click **Another address** (or **Use my domain**) and
   type it.
2. DNS: when the domain is connected to this project, Genesis adds the records itself.
   Otherwise add the records it shows where your domain's DNS is managed. Checking them and
   issuing the certificate usually takes a few minutes — click **Check again**.
3. Update your sign-in providers. Every enabled provider must list the new callback,
   `https://auth.yoursite.com/auth/v1/callback`, or its sign-in stops working after the
   switch. Google is checked for you (**Google lists it**). In Google Cloud open
   **Credentials**, your OAuth client, and add it under **Authorized redirect URIs**. For other
   providers add it where they list allowed callback or redirect URLs, then tick
   **I added it in …**.
4. Click **Switch sign-in to auth.yoursite.com**. From then on Google shows your address and
   sign-in emails link there. Your site keeps working on the old address too.

To undo it, click **Remove** (or **Cancel setup** while it is being set up): the address and
the DNS records Genesis wrote are deleted, and sign-in goes back to the original address —
so keep the original callback listed in your providers as well.

> **Note**
>
> This is for Dedicated Cloud. If you connected your own Supabase project with the
> [Supabase connector](https://support.estage.com/connectors-supabase), set a custom domain in your Supabase dashboard.

## Email tab — auth emails

Your site sends transactional emails for account flows. The **Email** tab controls both *how*
they're sent and *what they look like*.

### Sending (SMTP)

By default a built-in sender is used — fine for testing, but it's rate-limited. For
production, toggle **Use my own SMTP** and plug in any email service (SendGrid, Postmark,
Resend, AWS SES…): sender name and address, host, port, username, password.

### Templates

Six emails, each editable:

- **Confirmation** (verify email on sign-up)
- **Password Reset**
- **Invite**
- **Magic Link**
- **Re-authenticate**
- **Change Email**

For each you can edit the **subject** and the **HTML body**, with variables like the
confirmation link and the recipient's email available to insert. Don't want to hand-write
HTML email? Each template has an **Ask AI to design this email** bar — describe the look
(*"modern welcome email, brand color #4F46E5, friendly tone"*) and it generates the template
for you to tweak and save.