February 2022 Summaries

The guide demonstrates how to build a multi-tenant B2B application in Next.js using PropelAuth, enabling users to sign up, manage accounts, create or join organizations, invite coworkers, automatically admit users with matching email domains, and assign role-based permissions. PropelAuth supplies hosted authentication pages, configurable branding and sign-up fields, passwordless or password-based login, social sign-on options, transactional emails, and organization-management interfaces, while its React package provides an AuthProvider, user and organization data, access tokens, and redirects for login, signup, account management, and organization creation. The example uses organization helpers to display a user’s organizations and protect organization portal pages on the client by confirming membership, then sends JWT access tokens in authorization headers for authenticated API calls. On the Next.js backend, PropelAuth’s Node library validates access tokens and verifies that a requester belongs to the specified organization before returning organization data, ensuring that frontend checks are reinforced server-side.

PropelAuth offers hosted, customizable authentication interfaces and APIs designed to simplify user registration, team invitations, and organization management for products. It supports multiple login methods, including Microsoft, Google, GitHub, and other SSO providers, alongside passwordless email magic links and conventional email-password authentication, allowing businesses to offer lower-friction sign-in options without relying on a single provider. Developers supply OAuth client credentials while PropelAuth manages provider callbacks, PKCE-enabled OAuth flows, and edge cases such as safely merging user accounts based on verified emails. Its frontend libraries provide logged-in users’ identifiers and associated organization identifiers, while documentation provides step-by-step setup instructions for features such as Login with Microsoft.

Signup methods involve trade-offs between convenience and friction: email and password can work smoothly with password managers but may lead to forgotten-password churn, while passwordless magic links avoid passwords but require users to switch to email and wait for a link. Social login and single sign-on options such as Slack can combine familiarity with a relatively quick sign-in flow, allowing users to authorize sharing basic account information before being registered or logged in. PropelAuth supports Slack OAuth by managing the authentication flow, requires minimal setup, works with existing integrations without code changes, and automatically merges a Slack login with an existing account that uses the same email address.

PropelAuth now allows early-stage businesses to disable public signups, helping them restrict access to customers they explicitly approve, such as waitlist members, demo recipients, friends, or family. Enabling this setting removes public signup pages and related links while preserving login options, including SSO providers such as Google. SSO access remains available only to users with an existing verified account matching the login email address, allowing businesses to offer convenient authentication without permitting unapproved registrations. Administrators can manage approved users through the PropelAuth dashboard and retain full control over product access.

A new dashboard Notifications section lets teams receive Slack alerts whenever a user signs up, providing early-stage companies with immediate visibility into growth. Users can configure separate Slack webhook URLs for test and production environments to prevent test registrations from cluttering production notifications. For more complex responses to signups or other events, the platform also offers broader webhook support.

PropelAuth has introduced webhook support, enabling applications to receive reliable HTTP requests when events such as user sign-ups, organization membership changes, or role updates occur. These webhooks can support tasks including synchronizing user and organization data with a database, enrolling users in mailing lists, provisioning resources at registration, and updating billing as organization membership grows. Developers can configure separate test and production endpoints through the dashboard and consult an event catalog containing payload examples. The feature is powered by Svix, which provides automatic retries and event delivery logs for configured endpoints.

Role-based access control (RBAC) assigns application permissions according to user roles, illustrated through a team chat product where both Admins and Members can view and send messages but only Admins can access billing information. Using FastAPI and PropelAuth, the example verifies a user’s authentication token, confirms organization membership, and enforces a minimum Admin role before returning protected billing data. PropelAuth initializes verification metadata at application startup, allowing requests to be authenticated locally without external calls, while its B2B authentication features support organization creation, invitations, role management, and configurable sign-up interfaces. On the frontend, libraries can identify logged-in users through secure HTTP-only cookies, retrieve a user’s active organization and short-lived access token, and send that token with organization-specific backend requests. Requests from users who are not members of the specified organization are rejected, and PropelAuth provides managed workflows for invitations, emails, and role changes.