Identities

Identities are user accounts for your app or service. They make it easy to integrate a registration and login system into your app, and gives users the ability to create and manage their own data.

When a user registers an identity within your app and creates items, those items will be associated with that identity. Then, you can set up token permissions which allow identities to view and/or modify only their own items.

Identities can log in with a name or an email address and a password, stay logged in on several devices at once, and reset a forgotten password.

They can also sign in with a Google or GitHub account instead of a password, or as well as one. An identity's linked accounts are listed in its providers, when the account owner or the identity itself fetches it.

An identity may normally only write items it owns, so two people can never touch the same item. When they need to share one — a game, a shared document, a chat room — a list's write rules can declare shared update, delete;, which lifts the ownership check and lets the rules decide who may write instead. The item's real owner is still there for a rule to read.

JSONPad never sends email to your users. When an identity needs to reset its password or verify its email address, JSONPad issues a single-use token, and your app sends it, with your own branding. See password reset and email verification.

Identity object

{id: "5a44f978-f188-4179-b9f9-72509069f51b"
createdAt: "2026-09-23T21:08:39.220Z"
updatedAt: "2026-09-23T21:08:39.220Z"
user: {id: "c10c17b7-e800-4042-add3-a498065d512d"
createdAt: "2026-09-23T21:08:39.220Z"
updatedAt: "2026-09-23T21:08:39.220Z"
lastActiveAt: "2026-09-23T21:08:39.220Z"
activated: true
displayName: "Sample User"
description: "Sample user description"
}
name: "Sample Identity"
displayName: "Sample Display Name"
email: "identity@example.com"
emailVerified: true
hasPassword: true
tags: [0: "my-app"
]
group: "sample-group"
lastLoginAt: "2026-09-23T21:08:39.220Z"
activated: true
}

idstringUnique identifier for the identity.
createdAtstringDate and time the identity was created in ISO 8601 format.
updatedAtstringDate and time the identity was last updated in ISO 8601 format.
userobjectThe user who created the identity.
User attributes
- idstringUnique identifier for the user.
- createdAtstringDate and time the user registered in ISO 8601 format.
- updatedAtstringDate and time the user was last updated in ISO 8601 format.
- lastActiveAtstringDate and time the user was last active in ISO 8601 format.
- activatedbooleanWhether the user account is activated.
- displayNamestringThe user's display name.
- descriptionstringThe user's description.
namestringThe name of the identity. This also acts as the username for logging in.
displayNamestring | nullA public name for the identity, e.g. to show who created an item. Unlike the name, this isn't used for logging in, so it's safe to show to other users.
emailstring | null
The identity's email address. It can be used instead of the name to log in, and is unique within the identity's group (ignoring case).
Email addresses are personal, so this is only included when you fetch identities from the dashboard, or when an identity fetches itself. API tokens that can list identities don't see it.
emailVerifiedbooleanWhether the identity has proved that it owns its email address, by verifying it or resetting its password. Changing the email address marks it as not verified. Included along with email.
hasPasswordbooleanWhether the identity has a password. Included along with email.
tagsstring[]
Tags for grouping related resources together, e.g. ["recipe-app", "production"].
groupstringIdentities can be grouped together. This allows you to have multiple identities with the same name, but scoped to different apps or projects. Each group has its own settings, such as how long sessions last.
activatedbooleanWhether the identity is activated. Inactive identities are not accessible via the API, and cannot login.

Logging in and sessions

An identity logs in with its name or email address and its password, and gets an identity token. Send the token in the x-identity-token header (and the group in x-identity-group) to make requests as the identity.

Each login creates a new session, so an identity can be logged in on several devices at once (up to 20; logging in again after that ends the oldest session). Sessions last as long as the identity group allows. Logging out ends the current session, or every session with { "all": true }.

Every session ends when an identity's password is reset or changed by you, and every other session ends when the identity changes its own password. Deactivated identities can't log in, and their sessions stop working.

Passwords

New passwords must be at least 8 characters, and at most 72 bytes, long. Passwords are stored as bcrypt hashes and are never returned by the API.

To change its own password or email address, an identity must also give its current password in currentPassword. This stops someone who has got hold of an identity token from locking the real owner out.

2026-09-17