Send and verify a sign-in code
A person enters their email, receives a sign-in code and types it back. There is no password to choose, store, hash, leak or reset. The SDK sends the code and verifies it, and verifying resolves the session. From then on your app knows who the person is. A person can stay signed in on up to 10 devices, list them with g.auth.devices(), and sign one out or sign out everywhere; a sign-in from a new device or country emails them.
await g.auth.sendEmailCode(email);
await g.auth.verifyEmailCode({ email, code }); // resolves the session
const me = await g.auth.currentUser(); // who is signed in
// ...
await g.auth.logout(); // ends this device's sessiontry await g.auth.sendEmailCode(email) _ = try await g.auth.verifyEmailCode(email: email, code: code) let me = try await g.auth.currentUser()
A person's id field is userId. Use userId to link records to a person. Do not use id.
Keep each person's data separate
Sign-in tells you who someone is. A safety rule stops one person reading another's data. Every collection has one of eight plain-English safety rules, enforced on the server, and a query cannot return what its rule forbids. There is no access-control code of yours to misconfigure.
| Rule | What it means |
|---|---|
private | Each signed-in person sees and edits only their own records. |
shared | Every signed-in person reads every record and adds their own. |
admin_write | Everyone signed in can read. Only the app owner can write. |
public_read | Readable without signing in. Only the app owner writes. |
community | Readable without signing in. Any signed-in person posts and edits their own. |
addressed | The app owner creates records for one person. That person's list returns only their own, like an inbox. |
direct | People send to each other. The app owner can read them. |
app_only | Nobody using the app reads or writes it. Only the app owner, their server and relays reach it. |
// On a "private" collection, this returns only the signed-in person's notes.
const { records } = await g.collection("notes").list({ limit: 20 });Sign-in codes only
Gemmein signs people in with sign-in codes sent by email and nothing else. There is no Google, Apple or other social sign-in, and no password sign-in. If your app needs social sign-in, Gemmein does not fit it.
Prompt for your coding agent
Paste this into Cursor, Claude, Bolt or Lovable so your agent builds sign-in and data separation from the documented API.
Read https://docs.gemmein.com/llms.txt. I want sign-in without passwords for my AI app. Show me how to sign a person in with a sign-in code sent by email using g.auth.sendEmailCode and g.auth.verifyEmailCode, read the signed-in person, and store their data in a collection whose safety rule keeps each person's records private. Explain the eight safety rules and pick the right one for private per-person data. Note that sign-in is by emailed code only, with no social sign-in.
npx gemmein devRead the getting-started guideFrequently asked questions
Is there a password reset flow?
No. There are no passwords, so there is nothing to reset. People sign in with a fresh sign-in code each time.
Does it work on mobile?
Yes. The same sign-in code flow works through the JavaScript SDK, the Expo entry and the Swift package.