Add a login to your site
A page or route on a Tessryx site can require a sign-in. A visitor who isn't signed in goes to Tessryx, signs in with an email and password or with Google, approves your site the first time, and comes back to the page they asked for.
On every plan, and people who sign in to your site never use a seat. Sign-in on your own domain needs a plan with custom domains.
Your site never sees a password and keeps no user table. It gets a private id for each visitor, the same on every visit, and can keep their saved items or profile under it. Visitors don't use seats on any plan.
Try it
A page behind a sign-in
The visit, step by step
The members endpoint's auth
{ "required": true, "expose_identity": true, "on_unauthenticated": { "mode": "redirect" } }
What the page's workflow gets
Visit the page to see what its workflow is told about the visitor.
How it works
- 01
Gate the pages that need it
Each page or route has its own switch. The homepage can stay public while the members area and the routes it calls are gated.
- 02
Anyone, or only your team
With no roles listed, anyone with a Tessryx account gets in. An admin page lists roles, and then only people holding one of them in your workspace get through.
- 03
Choose what everyone else sees
A signed-out visitor can go straight to sign in or see a page with a button. A route a script calls can answer "not signed in" for the page to handle.
Questions
Do visitors need a Tessryx account?
They do, though it's free and Google works too. Your own user directory can't be plugged in.
What does my site learn about a visitor?
That they're signed in, and an id that's stable on your site and means nothing anywhere else. It doesn't get a name or email unless the visitor is on your team and the page is team-only.
Under the hood
The technical details
- auth.required
- Off by default. On its own it is a login wall: any signed-in Tessryx account gets in.
- flow
- OAuth 2.0 authorization code with PKCE, bound to the one site host (RFC 8707 resource), so a grant only works for that site. Consent is asked once per site.
- session
- A sealed, host-bound cookie lasting 30 minutes and renewed while the visitor is active. Signing in again is usually an invisible redirect.
- caching
- A gated page is never stored at the edge; at most the visitor's own browser keeps it.
Related features
Members areas with each visitor's own data
Let anyone who signs in into a members area and show each person their own things, like saved items, without learning who they are.
Admin pages only your team can open
Build an admin area into your live site that opens only for people with a role in your workspace. Remove someone's role and they're out within seconds.
What signed-out and refused visitors see
Decide page by page whether a signed-out visitor goes straight to sign in or sees a page with a sign-in button. A visitor who isn't allowed can get "access denied" or be sent somewhere else on your site.
Pages that know who's signed in
Add one script tag and the page knows whether the visitor is signed in as soon as it loads. It can send them to sign in without losing what they typed, and show team-only buttons to your team alone.