Sign-in for your app's users
How login works in the app you build: email and password, password reset, your own first admin account, Google and Microsoft sign-in, and bringing your own.
Ask your assistant to "add login" and your app gets its own sign-up, sign-in, and sessions, stored in your project's database. This page covers what that sets up, how you and your users get back in when a password is lost, and the other ways to sign people in.
Two different sign-ins
Your Floot account is how you sign in to floot.com. It has no password: you use an email link, Google, GitHub, or Microsoft. Your app's users are separate accounts that live in your app's own database, and each project has its own. This page is about the second kind.
What "add login" sets up
Sign-up and sign-in with email and password, sessions, and a login page, backed by tables in your project's database. If the project has no database yet, one is created for it. Too many wrong passwords lock an email out for a short while — by default, five failed tries within 15 minutes lock it for 15 minutes.
The preview and the published app use the same database, so the accounts are the same in both. The login pages themselves reach your published app at your next publish, as does any later change to sign-in.
Your own account
When your assistant sets up sign-in through the Floot connector, an account is created for you in the app at the same time: your Floot email, with the admin role and no password. To set the password, open your app's login page, click Forgot password?, and enter that email. No password passes through the chat. If an account with your email already existed, it is left as it was.
Forgot password
The login form comes with Forgot password?. It emails an 8-digit code to the account's address, and the user types the code and a new password into the same page. There is no link to click.
- A code lasts 15 minutes
- Only the newest code works; asking for another one cancels the one before.
- 5 tries per code
- After five wrong tries the code stops working and a new one has to be requested.
- 3 codes an hour
- Per account.
A successful reset signs the account out everywhere and lifts a lockout from earlier wrong passwords. The form answers the same way whether or not the email has an account, so it cannot be used to find out who is registered.
Until you verify a sending domain, the codes come to you
Reset codes go out through Floot's built-in email. Until your project has a verified sending domain, mail addressed to anyone other than you is delivered to you instead, with the intended recipient at the front of the subject. So you can always reset your own account with no email setup at all, but your users' codes land in your inbox. Verify a domain, then ask your assistant to change the reset email's From address to one at that domain. See Email.
Sign-in that was set up before this flow existed (early October 2026) does not have it. Ask your assistant to add a password reset to the login page.
Resetting someone's password yourself
The project and its database are yours, user accounts included. If a user cannot use the reset form, ask your assistant to do it for them:
Set a temporary password for jo@example.com in my Floot project xxx.Have the user change it once they are in. Floot support cannot do this for you: your app's users are in your database, not in Floot's.
Locked out of your own app
Try Forgot password? with your own email first; the code comes to you even with no email domain set up. If your account is missing, has the wrong role, or sign-up was closed before any account had a password, ask your assistant to restore your admin account. Floot tells your assistant that you are the project's owner, so it does not need to check who you are inside the app. If the step is stopped by your AI client rather than by Floot, see Connector troubleshooting.
To avoid getting there: do not close sign-up, or put every page behind login, before at least one account has a working password. And publish again after a change to sign-in, or the published app keeps the old behaviour.
Google and Microsoft sign-in
Ask your assistant to add Sign in with Google or Sign in with Microsoft. Floot brokers both, so there is no OAuth app for you to register and no client secret to store. They sit beside email and password on the same login page, and need the built-in sign-in set up first.
Other providers, and your own sign-in
Apple, GitHub, LinkedIn, Slack, and other OAuth providers work with your own OAuth credentials: register an app with the provider, ask your assistant to add the provider, and enter the client secret through the secure link it gives you — see Connecting external services. You can also ask for a different scheme altogether, or connect an outside auth service over its API.
An app does not need sign-in at all. And if the app is only for you and people you invite, such as a team tool, you may not need to build any: publish it privately and Floot handles the sign-in, with no passwords for you to manage.