Ulabase
Sign in

Your users

Sign-up, login and invitations

Registration, email verification, password reset, login with Google and team invitations, done by the service. You set the app name, the URLs and the emails.

The Sign-up and login feature gives your service registration, email verification, password reset, login with Google and team invitations. Your app shows the forms and the service does the rest. The Kit already wires the two together.

The Sign-up page: the feature enabled

Turn it on

Open Sign-up and login and click Enable. The page becomes the configuration form. Save applies every change at once; it takes up to a minute to reach every node of the service.

Tell it about your app

Field What it is for

App name

Shown in email subjects and on the login page.

Frontend URL

Where your app lives, such as https://app.example.com. Links in the emails are built from it.

Frontend app URL

Where a user lands after a link signs them in: after verifying their email, resetting a password, accepting an invitation or coming back from Google. Usually the app’s home for signed-in users, such as https://app.example.com/dashboard. Set it, or users land on the wrong page.

Choose the features

Each flow has a switch. Off, its endpoints answer 403.

Feature What the app calls

Registration and verification

POST /auth/register, then the link in the email hits GET /auth/verify and PATCH /auth/activate.

Password reset

POST /auth/forgot-password, then PATCH /auth/reset-password from the link in the email.

Team invitations

POST /auth/invite, GET /auth/teams, POST /auth/switch-team.

Social login (OAuth)

GET /auth/oauth/authorize/google, and the callback the service handles.

The Kit calls these for you: register(), login(), forgotPassword(), invite() and the rest.

Login with Google

  1. In Google Cloud Console, open APIs & Services and configure the OAuth consent screen.

  2. Under Credentials, create an OAuth 2.0 Client ID of type Web application.

  3. In the OAuth section of the Sign-up page, switch Google on. The console shows the callback URL of your service, such as https://c0ffee.ulabase.app/auth/oauth/callback/google.

  4. Add that URL to the client’s Authorised redirect URIs.

  5. Paste the client ID and secret into the Sign-up page, and click Save.

Once saved, the secret is never shown again.

Google then also appears on the OAuth login page an AI agent opens when it connects to your service over MCP, with the same accounts. A user who signs in there for the first time gets an account, as they would from your app. See The OAuth login page.

The emails

The service sends three emails for you: verification after registration, password reset and invitation. Each has a built-in template. Paste your own HTML to replace it, click Fill default to start from ours, and Preview to see it rendered. The {{app-name}}, {{first-name}}, {{verification-url}}, {{reset-url}}, {{invite-url}}, {{inviter-name}}, {{team-name}} and {{year}} placeholders are filled when the mail is sent. The Email page says how many you can send, and how to send from your own address.

What users cannot do to themselves

With the feature on, a user cannot change their own roles, teams or verification status through the /users API, whatever their permission says. Only registration, verification and invitations write those fields, through their own endpoints. So a user who may edit their profile cannot make themselves admin. Exemptions are described in accounts security.

Related pages

  • The Ulabase Kit: the client side of every flow here.

  • Users: the accounts these flows create.

  • Guards: for instance, block a user who has not accepted the current terms.

  • Email: quotas and your own sender address.