Auth & access

Passwordless auth for an AI app

People sign in with a one-time email code. There are no passwords anywhere in the system, so there is no password database to breach. Two SDK calls sign someone in, and seven server-enforced rules keep every customer's data apart, with no access code of your own to write.

See auth & data Read the docs

01 / OVERVIEW

Send a code, verify it, and the person is signed in.

There is no password to choose, store, hash, leak, or reset. A person enters their email, receives a one-time code, and types it back. From that point your app knows who they are. The riskiest part of most auth systems, the password store, does not exist here.

Sign-in is two SDK calls. Keeping people's data apart is a rule set on the collection, not code you write.

02 / SIGN-IN

Two calls: send the code, verify the code.

The SDK sends the code and verifies it. Verifying resolves the session. From there you read the signed-in user and gate the app.

await g.auth.sendEmailCode(email);
await g.auth.verifyEmailCode({ email, code });   // resolves the session

const me = await g.auth.currentUser();            // who is signed in
// ...
await g.auth.logout();                            // ends the session

The same, on Apple platformsSwift

try await g.auth.sendEmailCode(email)
_ = try await g.auth.verifyEmailCode(email: email, code: code)
let me = try await g.auth.currentUser()

A person's id field is userId. Key your per-user records off that, not id.

03 / DATA ISOLATION

The rule sits on the collection, not in your code.

Sign-in tells you who someone is. Isolation is what stops one customer reading another's data. In Gemmein every collection is governed by exactly one of seven plain-English rules, enforced on the server. There is no access rule in your code to misconfigure. A query cannot return what its rule forbids.

Rule	What it means
`private`	Each signed-in user sees and edits only their own records.
`shared`	Every signed-in user reads every record and adds their own.
`admin_write`	Everyone signed in can read. Only the owner can write.
`public_read`	Readable without signing in. Only the app owner writes.
`community`	Readable without signing in. Any signed-in user posts and edits their own.
`addressed`	The owner creates records for one user. That user's list returns only their own, like an inbox.
`direct`	Users send to each other. The owner can read them.

Reading respects the ruleJavaScript

// On a "private" collection, this returns only the signed-in user's notes.
const { records } = await g.collection("notes").list({ limit: 20 });

You pick the rule when you create the collection. The server enforces it on every read and write. See the data model.

04 / SCOPE

Email codes only.

Gemmein signs people in with one-time email codes and nothing else. There is no Google, Apple, or other social sign-in, and no password login. If your app needs a social provider, Gemmein is not the fit, and it is better to know that now than to design around a surface that is not there.

05 / FOR YOUR CODING AGENT

Give your agent the full task.

Building with Cursor, Claude, Bolt, or Lovable? Paste this so your agent builds sign-in and data isolation against the real contract.

Prompt for your coding agentCopy and paste

Read https://docs.gemmein.com/llms.txt. I want passwordless sign-in for my AI app. Show me how to sign a person in with a one-time email code using g.auth.sendEmailCode and g.auth.verifyEmailCode, read the signed-in user, and store their data in a collection whose rule keeps each user's records private. Explain the seven access rules and pick the right one for private per-user data. Note that Gemmein uses email codes only, with no social sign-in.

npx gemmein devRead the getting-started guide

06 / FAQ

Frequently asked questions.

Is there a password reset flow?

There are no passwords anywhere in the system, so there is nothing to reset and no password database to breach. People sign in with a fresh one-time email code each time.

Can people sign in with Google or social login?

No. Gemmein signs people in with one-time email codes only. There is no Google, Apple, or other social sign-in.

How is one customer's data kept from another's?

Data lives in collections, each governed by exactly one of seven plain-English rules, enforced on the server. Under the private rule, each signed-in user sees and edits only their own records. There is no access rule in your code to get wrong.

Does it work on mobile?

Yes. The same email-code sign-in works through the JavaScript SDK, the Expo entry, and the Swift package.

07 / RELATED

See if Gemmein fits your app.

Point your coding agent at docs.gemmein.com/llms.txt and ask it to confirm the fit before it builds.

Read the builder guide