Identity groups

Every identity belongs to a group. Groups keep the identities for different apps apart (names and email addresses only need to be unique within a group), and each group has its own settings for signing in.

An identity with no group belongs to the default group. Requests for identities in a named group send the group's name, in the group field when registering or logging in, and in the x-identity-group header when making requests as an identity.

Managing groups

You don't need to create groups before using them: a group is created, with the default settings, the first time an identity uses it. To see and change a group's settings, open Identity groups in the dashboard. You can also create a group there before any identity uses it, so its settings are in place from the start.

A group's name can't be changed, because identities, token permissions and your apps all refer to it. A group can only be deleted once it has no identities.

Sessions

When an identity logs in, it gets an identity token for a new session. The group's session lifetime decides how long that token works before the identity has to log in again: 30 days for a new group, or never. Changing the lifetime only affects sessions started afterwards.

Requiring an email address

Turn on require email if your app relies on email addresses, e.g. for resetting passwords. Identities in the group can then only be registered or created with an email address, and can't remove it. Identities that already exist without one aren't affected until their email address or group changes.

Password reset and email verification tokens

Each group sets how long password reset tokens (1 hour by default) and email verification tokens (1 day by default) last, and how they reach your app: returned to the caller, or sent to a webhook. See token delivery.

Settings

This is how a group looks in the dashboard's JSON view: