User AuthenticationA place for your members.

Let visitors create a website member account.

Stop new registrations while existing members keep their accounts.

Require a valid invitation before an account can be created.

Current invitations grant roles to an existing verified member; they do not restrict registration.

Review applicants before granting approved-member access.

Owners and explicit site admins can approve or deny pending memberships. Approval still requires email verification and does not bypass suspension.

Invite one email address to receive selected website roles.

Acceptance requires a signed-in verified member using the invited address.

Invite a reviewed list of people in one operation.

Use expiring, single-use invitations and revoke unused ones.

Create a new invitation when an older one expires or must be replaced.

Reissue an invitation safely and show its latest delivery state.

Collect the member name and email required by the account flow.

Add approved questions beyond the fixed account fields.

Use up to 12 typed text, long-answer, choice, checkbox, or number fields. Registration answers stay private to authorized website management.

Choose which custom questions a new member must answer.

The managed signup screen and server validate answers against the current website field settings.

Show relevant questions based on earlier answers.

Divide longer registration forms into clear steps.

Apply supported rules before accepting an application.

Limit registration to approved email domains.

Record when the member accepted the registration terms.

Versioned terms records are a separate roadmap item.

Record the exact terms version accepted by each member.

Keep optional promotional permission separate from joining.

Email campaigns belong to an installed marketing app.

Request additional approved information after registration.

Sign in with the email and password for this website.

Allow a chosen username as a sign-in identifier.

Use a verified phone number as an account identifier.

Let visitors join with Google or return to a connected website account when enabled.

Live published-site checks passed for explicit connection by an existing verified website member, Google-first signup and returning Google sign-in. Each published HTTPS website must enable its Google connection. Registration questions, terms, approval and enrolled MFA still apply. Matching emails never link accounts, and website members do not gain platform access. Confirm this website’s email delivery and physical-device security before launch. Facebook remains deferred.

Connect an approved external identity service.

Sign in through an expiring, single-use email link.

Enter a temporary code delivered by email.

Enter a temporary text-message code.

Needs an SMS provider, abuse controls, and explicit usage limits.

Use a supported device credential instead of a password.

Optional exact-host passkeys are available on trusted HTTPS websites. Physical device acceptance remains part of production validation.

Use a supported phone credential to sign in on another device.

Keep a limited temporary identity before full registration.

Keep permitted guest data when a permanent account is created.

Confirm ownership using an expiring, one-time email link.

A working email provider and published account runtime are required.

Confirm ownership of a supplied phone number.

Request another verification email within sending limits.

Show whether a member has proved ownership of their email.

Request and use a single-use password reset link.

Completing a reset invalidates existing sessions.

Replace a password after proving current account control.

Fresh account proof is required. A successful change retains the current proved session and revokes other sessions; it also invalidates outstanding recovery credentials.

Verify a replacement email before changing the account identity.

Verify a replacement phone number before relying on it.

Review, add, or remove supported sign-in methods.

Link identities only after proof of control of both accounts.

Use a separately approved recovery method when the main one is lost.

Provide a documented, auditable recovery process for difficult cases.

Enroll an authenticator app for rotating verification codes.

Members can enable an optional authenticator after proving control of their website account.

Use a supported text-message challenge after sign-in.

Use compatible physical security keys.

Keep more than one enrolled authentication method.

Save single-use emergency codes for a lost authenticator.

Securely add and remove authentication methods.

Enrollment and removal require account security verification.

Let a member enable an additional factor.

Require authenticator verification for every website member.

Members without an authenticator must complete enrollment before using member pages. Sessions that no longer meet the policy are revoked. Real physical-authenticator checks remain part of production acceptance.

Require authenticator verification for selected website roles.

Owners choose existing roles from this website. The policy does not grant roles, bypass approval, or change platform Staff OS access. Physical-factor acceptance remains pending.

Ask for fresh verification before a sensitive action.

Limit how long an approved device can avoid another challenge.

Add verification when a supported risk signal warrants it.

End the current member session.

Keep a sign-in for the configured persistent-session period.

Require sign-in after a configured inactive period.

Expire ordinary and persistent sessions after configured periods.

Review up to 50 current browser sign-in sessions.

Shown browser details describe sessions, not confirmed physical devices or current online presence. A has-more indicator identifies the bounded list.

Revoke a selected browser sign-in session with fresh account proof.

Revoking the current session signs out this device. Each operation is limited to the member’s account on this website.

End all browser sessions for this website account.

Fresh account proof is required. Signing out everywhere includes the current session; it does not affect accounts on another website.

End a member’s active sessions from the owner workspace.

Limit the number of simultaneous sessions for one account.

Replace session credentials under a bounded renewal policy.

Invalidate previous sessions when a password reset succeeds.

Challenge or invalidate access after other sensitive account changes.

Let a member review their own past sign-in activity.

View identity and verification, edit supported profile details, and open account security controls.

Members can edit their display name and select an owner-approved avatar. Password and session actions require fresh proof. Email changes remain pending acceptance.

Let signed-in members update their display name.

This changes the website profile name, not the account email, roles, approval state, or other app records.

Choose an image explicitly approved by the website owner.

Selection is limited to approved same-site media. Members cannot upload arbitrary profile images through this feature.

Store approved profile information relevant to the website.

Choose which fields can be exposed in approved public experiences.

Use member-selected language and time-zone preferences.

Let members control supported nonessential messages.

Manage passwords, authenticators, passkeys, and browser sessions in the account controls.

Use the member’s account page, configured dashboard account widget, or published account menu. Physical passkey/authenticator checks remain part of production acceptance.

Show the external sign-in providers attached to an account.

Explain optional missing profile details.

Temporarily deactivate an account with a defined return process.

Request removal through a controlled account-data workflow.

Require a website member session before serving a private page.

Require verified email for member authentication when enabled.

Per-page verification policies are not yet included.

Restrict approved-member areas until an application is accepted.

Create and assign website roles.

Website roles do not grant Site OS or LumeFrost Staff OS access.

Organize groups independently of sign-in methods and roles.

Choose Everyone, Members, or selected roles for a page.

Save and publish page access changes.

Apply server-backed rules to selected sections or components.

Control supported editing, downloading, and approval actions.

Allow a member to access their own app records without exposing another member’s data.

Use a synchronized membership entitlement to grant access.

Requires a membership and billing integration with a defined failure/cancellation lifecycle.

Apply approved account or resource attributes to access decisions.

Use project or delegation relationships in authorization.

Start or expire supported permissions at configured times.

Authorize access to media used exclusively by protected pages.

An arbitrary hidden link is not a private-file rule.

Send an unauthorized visitor to the appropriate access step.

Keep runtime access closed when installation or entitlement becomes unavailable.

Uninstall revokes member sessions and action tokens while retaining supported account data.

Browse members belonging to this website.

Find members by name, email, and supported account status.

Search the server-backed member directory in pages of up to 50 records.

Filters apply before pagination; the displayed page is not a complete member export.

Inspect permitted member details, roles, and activity together.

Review verification state and suspend or reactivate members.

Reactivation does not create email-verification proof.

Stop a member from signing in and revoke existing sessions.

Assign only roles belonging to the same website.

Trigger verification or recovery messages through a controlled owner action.

Review and apply supported changes to multiple members.

Download up to 2,000 recent member records belonging to this website.

Included owner export requires site-management permission. Exports exclude passwords, tokens, MFA secrets and private registration answers; protect the downloaded file.

Download up to 2,000 recent membership and sign-in events for this website.

Included owner download is bounded to the last 30 days. It does not export private event metadata or establish an external event-monitoring integration.

Import permitted profiles through a bounded, validated and audited workflow.

The current member directory CSV is an export only. Importing profiles, resolving duplicates and migrating credentials remain separate unfinished workflows.

Keep private owner context separate from public member profiles.

Require site-management capability for account administration.

Website members and roles do not become platform staff.

Provide a tightly controlled, visible support session.

Provide the installed /signup account-creation page.

Provide the installed /login account-access page.

Use managed forgot-password, reset-password, and verify-email flows.

Place cards that open sign-in, registration, recovery, or My account.

These open managed routes; they are not inline account forms.

Place working account forms within ordinary authored pages.

Show guest sign-in links or the signed-in member’s name, account shortcut, and sign-out controls.

Available as the Member Account Menu editor widget on a published website.

Place supported profile and security interfaces.

Offer a controlled authentication dialog alongside dedicated pages.

Customize headings, labels, layout, colors, spacing, width, and type size.

Customize form structure while preserving required validation.

Configure supported provider-branding removal and email appearance.

Run member account routes on the site’s resolved published hostname.

A separate custom identity-provider domain is not configured by this feature.

Translate supported account screens and messages.

Use labeled inputs and appropriate account/password autofill hints.

This is not a claim of complete accessibility certification.

Return members to permitted pages or configured role destinations.

Preview form appearance in the editor before publishing.

Test configured member states without using real credentials.

Generate expiring verification links for site members.

Generate controlled password-recovery emails.

Queue invitations for a published account runtime and retain a private manual-code fallback.

Queued or provider-accepted does not prove inbox delivery. An unavailable runtime keeps the invitation for private manual sharing.

Notify members about supported credential and security changes.

Send optional account-onboarding messages.

Customize supported account-email copy and branding.

Use the member’s supported language in account messages.

Connect an approved sender domain or mail provider.

No provider is configured or verified by a roadmap row.

Distinguish queued, sending, provider-accepted, failed, and manual invitation states.

Review the latest 25 verification, recovery, and invitation sending receipts.

The timeline excludes message bodies, action URLs, and recipients. Provider acceptance is not inbox confirmation.

Perform a supported retry with duplicate-send and abuse controls.

Limit repeated verification, recovery, and invitation requests.

Manage promotional campaigns separately from required account messages.

Connect defined nonpaid benefits to member accounts.

Grant synchronized benefits according to a paid plan.

Connect recurring billing to a defined access lifecycle.

Grant supported access after a one-time purchase.

Define temporary benefits and their billing consequences.

Apply eligible purchase discounts through a billing app.

Use a supported payment checkout without collecting credentials here.

Synchronize a member’s plan and permitted benefits.

Handle supported mid-cycle billing adjustments.

End billing and access under an explicit policy.

Handle retries and access changes after failed payments.

Define whether benefits continue during a billing problem.

Let members manage supported subscriptions and payments.

Update supported benefits after financial reversals.

Grant access for multiple people under one purchase.

Release supported benefits over a configured schedule.

Keep website account identity separate from platform accounts.

An app must still implement its own data and action authorization.

Show the member’s permitted purchases in a store app.

Connect member appointments to a booking app.

Connect member tickets and event information.

Connect lessons and progress to a courses app.

Publish only approved member-directory information.

Associate permitted contributions with a member identity.

Connect conversations to authorized community accounts.

Keep member selections in the app that owns them.

Connect rewards to the correct member account.

Protect a member’s own submissions through a forms integration.

Connect permitted support conversations to an account.

Offer role-aware welcomes, links, and account shortcuts.

Manage default and role-specific member dashboards in the Dashboards tab. Existing standalone installations and their layouts remain compatible.

Expose a documented account interface for approved custom components.

Resolve site-bound member sessions on the server.

Internal helpers are not a supported external SDK.

Expose only approved member information to supported components.

Allow narrowly scoped backend member operations.

Deliver supported account lifecycle events to approved destinations.

Bound retries and prevent duplicate business actions.

Run approved logic at supported account lifecycle points.

Store approved additional member fields.

Include approved attributes in supported identity tokens.

Connect account IDs to authorized records in another system.

Support a documented mobile authentication flow.

Separate member identity configuration and provider credentials by environment.

Migrate approved accounts without unsafe credential assumptions.

Validate the member’s permitted return-to and configured page destination.

Limit each connected app’s access to supported member data and actions.

Group members within a shared business account.

Invite colleagues through approved organization administration.

Apply permissions within a company account.

Switch between organizations a person belongs to.

Prove control of supported company email domains.

Route a member to their organization’s supported sign-in.

Connect a supported enterprise SAML identity provider.

Company Sign-in is planned and not installable.

Connect a supported company OIDC identity provider.

Create approved membership after a validated company sign-in.

Provision, update, and deactivate accounts from a company directory.

Translate approved directory groups into app roles.

Require the company-managed login method.

Manage one organization without platform-wide privileges.

Apply supported policies independently per business account.

Hash member passwords with salted bcrypt instead of storing readable passwords.

Require encrypted production transport for account traffic.

Production host and provider configuration still require deployment verification.

Store hashes of unpredictable session and action tokens with expiration.

Browser-held member tokens remain subject to the site’s script and device security.

Restrict repeated attempts with configured lockouts and request limits.

Use additional supported signals to detect reused stolen credentials.

Reject known unsafe passwords during credential setup.

Add approved challenges to supported suspicious flows.

Avoid unnecessarily disclosing whether an email has an account.

This does not assert constant-time behavior for every account route.

Expire and consume recovery credentials so links cannot be reused.

Review and strengthen all browser account-change boundaries.

Check website membership and roles before serving protected content.

Prevent one website member identity from authenticating to another site.

Require fresh proof before high-impact member changes.

Record supported account and owner administrative events.

A recorded event is not a guarantee of automated incident response.

Investigate signals and perform documented recovery actions.

Start with the name, email, and account lifecycle information needed.

Limit account and owner workspace access to authorized actors.

Apply explicit access rules to additional member fields.

Prepare permitted account and related app data for an individual member data request.

The current member directory CSV contains up to 2,000 recent website member records and excludes private registration answers. It does not complete an individual member data-request workflow.

Remove supported data with clear handling of related app records.

Account deletion and subscription cancellation have different lifecycles.

Retain supported consent versions and acceptance times.

Apply documented retention to supported identity and event data.

Import approved profiles with validation and duplicate handling.

Move only supported credential formats through an approved process.

Migrate supported accounts as they successfully sign in.

Resolve duplicate profiles without unsafe identity merging.

Offer supported deployment locations with explicit data boundaries.

Provide current product, processing, and operational documentation.

A provider certification does not certify every customer website.

Show registered, active, verification-pending, and suspended account totals.

Active describes account status, not today’s active visitors.

Count member accounts created in the last 24 hours.

This counts created accounts, not completed email verifications.

Show proved email ownership and the number of website roles.

Count sessions that have not expired or been revoked.

An unexpired session does not mean that a person is online.

Measure member activity across an explicit timeframe.

Review UTC daily registrations, successful sign-ins and denied events for the last 30 days.

Included reports show event counts, not unique visitors or a conversion funnel. Available records and their retention determine the report.

Review measured outcomes and drop-off by a selected period.

Count recorded denied account events in the last 24 hours.

Review a bounded recent list of account and owner actions.

The current workspace returns the latest 40 events.

Compare page access modes and a bounded list of restricted pages.

The owner summary lists up to 50 restricted pages; save and publish access changes in the editor.

Show current installation, publication, and resolved website address.

Provider sending receipts and runtime availability are separate signals.

Review supported event periods with documented retention.

Send approved security events to another monitoring system.

Show explicit included account usage and applicable limits.

Expose included volume and any consumption-based limits.

Show supported integration capacity and remaining allowance.

Warn owners before a supported limit is reached.

Offer a defined higher support service level.

Provide separately agreed availability and support terms.

Support a reviewed move from another member system.

Prove control of a supported wallet without claiming real-world identity.

Authenticate an approved service without a human sign-in.

Grant narrowly scoped access to automated systems.

Apply supported credential and device-security requirements.

Use approved device conditions from an identity environment.