Users & profiles

A user is a person who can sign in to your application. Each user belongs to a single instance and carries a profile, one or more ways to sign in, and a history of sessions and devices.

What a user record holds

• Identifiers — email addresses, phone numbers and/or a username. A user can have several, with one marked primary.

• Profile — first name, last name, avatar image and any public metadata you store.

• Authentication factors — password verifier, connected social accounts, passkeys, and enrolled MFA (TOTP, backup codes).

• Organization memberships — which tenants they belong to and with what roles.

• Sessions & devices — active sessions, the devices behind them, and last-seen times.

• Metadata — structured data you attach: public (readable by the frontend), private (backend only) and unsafe (writable by the user).

Managing users in the dashboard

Open Users for the selected instance to:

• Search and filter by email, name, sign-up date or last activity.

• Inspect a user's profile, connected accounts, MFA status, sessions and devices.

• Create a user manually (useful for seeding or support).

• Ban / unban a user to block sign-in without deleting their data.

• Impersonate a user to reproduce a support issue, safely and audibly (every impersonation is written to the audit log).

• Revoke sessions on one device or everywhere at once.

• Delete a user and their data.

Metadata: where to put what

Never store secrets in public or unsafe metadata — the frontend can read (and, for unsafe, write) them.

Next

Understand what users carry between requests → Sessions & JWTs.