Lepsto Users
Add end-user authentication and manage the accounts that belong to your product.
Lepsto Users provides sign-in and a user directory for your product. Customers can authenticate with passwords, email codes, magic links, Google, GitHub or passkeys. You can search their records, manage access and export the directory.
Each product has its own users. IDs and accounts are not shared between products, and the same email address can identify a different person in each.
The model
The authentication model has four parts:
- Product: holds sign-in methods, session lifetimes and allowed browser origins. See authentication configuration.
- End-user: the durable account for someone using your product. Store its stable, opaque ID in your database; email addresses can change or be reassigned. See user management.
- Identifier: an address associated with the account. Authentication uses email addresses; a user can have several, with one primary. Verification belongs to an individual address.
- Session: one signed-in device. Revoke a session to end access on that device, or revoke all sessions to sign the user out everywhere. See sessions and tokens.
Credentials are separate from identifiers: a password, linked Google or GitHub account, enrolled authenticator or passkey proves access to the account. A user cannot remove their last usable sign-in method.
What you get
Surface | What it provides |
|---|---|
API | Browser sign-up and sign-in, backend code exchange and session refresh. Directory administration uses a separate management API with your platform identity. |
Client libraries | @lepsto/sdk/users/server for backend token operations; @lepsto/sdk/users for the browser; @lepsto/sdk/users/react for hooks and guards; @lepsto/sdk/users/react/ui for components. Each documented authentication flow has a library call. |
Prebuilt React components | <SignIn/>, <SignUp/>, <UserButton/>, <UserProfile/>, <MfaSettings/> and <PasskeySettings/> render account screens in your application, styled through theme. Your backend supplies the PKCE challenge for redirect handoff and exchanges the returned code. |
Management app | Sign-in metrics, user search, sessions and security history; ban and unban, invitations, account creation, import and export; key and webhook management; authentication configuration. |
What it does not do
The authentication model does not provide:
- Organizations, teams or memberships between your end users.
- Enterprise single sign-on.
- SMS or phone-number sign-in.
- Anonymous users.
- Native mobile libraries. Mobile applications can use the same token exchange described in the browser and backend guides.
Next steps
- Sign in your first end-user: seven steps from an empty product to a signed-in user your own backend can read.
- Configure authentication: turn on the methods you want, and set the policy and lifetimes they obey.
- Run a sign-in flow: what each method asks of your code, step by step.
- Add two-factor authentication and Add passkeys: the two self-service screens
@lepsto/sdk/users/react/uiships ready-made.