> For the complete documentation index, see [llms.txt](https://docs.taskade.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.taskade.com/run-your-business-on-genesis/run-your-business/add-login-and-roles.md).

# Add Login & Roles

Taskade Genesis apps can ship with real user accounts and secure sign-in built in, powered by [GenesisAuth](/community-and-sharing/community-and-sharing/genesis-auth.md). To add login, you don't configure anything — you describe the need when you build the app (for example, *"users can sign in to see their own dashboard"*), and Taskade Genesis wires up the sign-in component, session handling, and per-user data access automatically.

{% hint style="success" %}
**The short version:** Describe an app that needs accounts, and your app gets a working login screen. Then manage who gets in from the **App Users** tab in your app's settings.
{% endhint %}

***

## When to use what

GenesisAuth is part of a broader access-control story. Pick the control that matches who needs to get in and how locked-down it has to be. Every option below is no-code.

| Control                             | What it does                                                             | When to use                                                  |
| ----------------------------------- | ------------------------------------------------------------------------ | ------------------------------------------------------------ |
| **GenesisAuth (App Users)**         | Account-based sign-in for your app's end users                           | Any multi-user app — external clients, members, or customers |
| **Workspace SSO**                   | Lets your Taskade workspace members sign in with their existing identity | Internal tools for your own team                             |
| **Password-protected public links** | A single shared password on a link                                       | A quick gated preview                                        |
| **Private / Unlisted visibility**   | Controls whether the app can be discovered                               | Non-indexed, share-by-link only                              |
| **Public agent tool opt-out**       | Keeps sensitive tools workspace-only                                     | Apps that publish an AI agent                                |

For external customers and members, reach for **App Users**. For your own staff, **Workspace SSO** means no second account to manage. For a fast, low-stakes gate, a **password-protected link** is enough.

{% hint style="info" %}
The **App Users** tab is currently in Beta and rolling out across paid plans.
{% endhint %}

***

## How to turn it on

You won't find a switch to flip — you ask for it in plain language.

1. In Taskade Genesis, describe an app that needs accounts. Include phrases like *"a client portal where each client has their own dashboard"* or *"a members-only knowledge base."*
2. Taskade Genesis generates the app **with the sign-in component already in place**.
3. Open your app's settings and go to the **App Users** tab to invite people, suspend access, or remove accounts.

If your first prompt didn't add login, you can ask Taskade Genesis to *"add sign-in for users"* later while editing the app.

For the full walkthrough — the App Users tab, Workspace SSO, custom-domain sign-in, and the security model — see the source page:

{% content-ref url="/pages/hKwzStqcwyuCZmgrLafr" %}
[GenesisAuth](/community-and-sharing/community-and-sharing/genesis-auth.md)
{% endcontent-ref %}

***

## Give each user only their own rows

For a client portal or member app, signed-in users usually shouldn't see each other's records. Turn on **Private per-user data** (row scoping) when you publish:

1. Open your app's **publish menu** and enable **Private per-user data**. (The option appears for apps built on the current app template with sign-in enabled; turning it on rebuilds and republishes the app.)
2. Pick — or add — a dedicated field on your project that stores each row's owner. Rows created **through the app** are tagged to the signed-in user automatically.
3. Publish. Each signed-in user now sees only their own rows. Rows with no value in the owner field are hidden from app users entirely — the safe default.

{% hint style="info" %}
Before you launch, sign in as a test user and confirm they see only their own records — this pairs with the [go-live checklist](/run-your-business-on-genesis/run-your-business/go-live-checklist.md) item on per-user data isolation. Data you add inside Taskade (rather than through the app) won't have an owner tag, so it stays hidden from app users until you assign one.
{% endhint %}

***

## Pair it with a custom domain

GenesisAuth works on apps hosted at your own web address with no extra setup. Combining sign-in with a [custom domain](/taskade-genesis/space-apps-guide/custom-domains.md) gives end users a fully branded, production-ready product.

{% hint style="warning" %}
**Never put real credentials in your app.** If your app calls an external service that needs an API key or token, store it in [App Secrets](/taskade-genesis/space-apps-guide/app-secrets.md) — a per-space vault — instead of writing it into your app. Secrets stay on the server and never ship in your exported app bundle.
{% endhint %}

***

## Next steps

* New to building? Start with [Getting Started](/taskade-genesis/genesis/getting-started.md).
* Read the full [GenesisAuth](/community-and-sharing/community-and-sharing/genesis-auth.md) reference for access control and security best practices.
* Connect a [custom domain](/taskade-genesis/space-apps-guide/custom-domains.md) for a branded, production sign-in.
* See login and roles in action: [Build a client portal](/run-your-business-on-genesis/run-your-business/build-a-client-portal.md) and [Build an ops dashboard](/run-your-business-on-genesis/run-your-business/build-an-ops-dashboard.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.taskade.com/run-your-business-on-genesis/run-your-business/add-login-and-roles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.