Users

The Users section lists everyone with an account on your sign in service. Search by name or email, then open a person to see their profile, roles, sign in methods, sessions, their API keys and the apps they've connected.

What you can do

Action	What happens
Change roles	Their permissions change at their next token refresh, at most one access token lifetime later. A person can have up to 20 roles
Suspend	Signs them out everywhere. They can't sign in, and their apps and API keys stop working for them. Access tokens already issued keep working until they expire: your access token lifetime, 10 minutes by default, for your own apps, and 10 minutes at most for apps they connected. Unsuspend them at any time
Sign out everywhere	Ends every sign in session, and the refresh tokens tied to them
Revoke API keys	Revoke one of their keys or all of them. A revoked key stops working at your APIs within 30 seconds
Disconnect an app	Its refresh tokens for them stop at once and it has to ask them again. Access tokens it already has work until they expire
Send a password reset	Emails them a link to choose a new password. Their current password keeps working until they do
Reset two step verification	For someone who lost their authenticator app and recovery codes. Turns two step verification off, deletes their recovery codes and passkeys, signs them out everywhere and emails them. Check it's really them first. Needs the admin role
Remove photo	They go back to the default avatar
Delete	Deletes the account with its profile photo, sessions, passkeys, API keys and connected apps, and emails them. Needs the admin role. This can't be undone

Changes are recorded in the service's Activity tab with who made them.

Inviting people

Invite someone by email and pick the roles they start with. They get an email with a link to set up their account, which works for 14 days. Inviting the same email again replaces the old invite. Invites work whatever the sign up mode, so you can run an invite only service for your team or your customers.

Sign up

Under Sign in you choose how people get in:

• Sign in methods: passwords and passkeys. The external providers you set up are on the Connections tab.
• Who can sign up: Anyone, or Only people you invite.
• Sessions and tokens: how long sign in sessions and access tokens last. See Sessions and tokens.

New users get your default roles.

The user limit

Your plan sets how many users a service can have. When you reach it, new sign ups wait: password sign ups, external sign in and invites all show a polite message, and workspace owners and admins get an email once a day while it happens. People who already have an account keep signing in. See pricing.

What your users see

Everyone gets Account pages on your sign in service, with your name and logo:

• Profile: name, email and a profile photo. People without a photo get a default avatar, so the picture claim always has a URL.
• Security: password, two step verification, passkeys and connected providers such as Google.
• Sessions: where they're signed in, with a button to sign out of each.
• Connected apps: the apps they've allowed, with a button to disconnect each.
• API keys, when you turn them on.
• Your data: a copy of what the service holds about them, and a way to delete their account.

Every page, including the consent screen and the sign out page, ends with the same footer: your support address and privacy policy, the Powered by MicroAuth badge unless your plan removes it, and a Report abuse link to MicroAuth.

Passkeys and two step verification work the way they do on developer portals. Signing in to a developer portal describes them from the user's side.

From your own code

The platform API has the same actions, so your back office can find, suspend or sign out a user without the dashboard.