How to add sign-in to an app your coding agent built

Asking a coding agent for "a login page" gets you a login page. It does not get you the part that matters, which is the server refusing to hand one person's data to another. This page covers what sign-in is made of, the three ways to get it, and a test you can run yourself without reading any code.

What sign-in is made of

A working sign-in is five things, and the form is the smallest of them:

• Accounts. Somewhere that stores who has signed up, with passwords kept in a form that cannot be read back.
• Sessions. A way for the server to know, on every request, who is asking. A session should expire, and signing out should end it.
• Password reset. An email with a link that works once and stops working soon after.
• A check on every request for data. Each time the browser asks the server for something, the server decides whether this person may have it.
• Data that belongs to someone. Every saved thing carries the id of the person who owns it, and every read filters by that id.

The last two are where apps built by an agent go wrong. The screens look right, sign-in works, and the server still answers anyone who asks it directly.

Three ways to get it

Have the agent write it. It can. You then own password storage, sessions, the reset flow, and every fix they need later, in code you may not be able to read. If you go this way, ask the agent to explain each of the five parts above in plain words and show you where it lives.

Add a sign-in service. A hosted service keeps the accounts and sessions, and the agent connects your app to it. That removes the hardest code. It does not remove the last two parts of the list: your server still has to check each request and filter each read, and the agent still has to write that for every screen it adds.

Start on a platform where sign-in is part of the platform. That is how nerdsystem works, and it is described below.

Whichever you choose, the test in the next section is the same.

A test you can run without reading code

1. Create two accounts in your app, in two different browsers. Call them A and B.
2. As A, save something only A should see.
3. As B, look for it. Try the list, the search, and any address you copied from A's browser.
4. Sign out, then paste one of those addresses again.

If B or a signed-out visitor sees A's data, the app is not ready for strangers. Then put these to your agent, word for word:

• "List every route the server has. For each one, say who is allowed to call it and where in the code that is enforced."
• "For every table that stores something a user saved, show me the query that reads it and the part that limits it to the signed-in user."
• "Is anything taken from the browser and trusted, such as a user id, a role, or a price?"

Hiding a button is not protection. If only an admin may delete something, the server has to refuse everyone else, whatever the screen shows.

How it works on nerdsystem

Sign-up, sign-in, sign-out, and password reset run as a service. Your agent does not write them. It places the forms wherever the design wants them, and keeps a route to signed-in people with one line, requireAuth(), or to one role with requireRole("admin"). Roles such as admin and member are a list the platform keeps, not something written into the code.

Every route is closed unless the agent names it as public, so a route it forgets to protect answers nobody. New apps also carry tests that call every route as a signed-out visitor and call every route with an id in its address as a second user. A deploy stops when one of those tests fails or is missing. Apps started on a version older than 0.0.14 get a warning with the steps to add the tests instead.

What it does not do: sign-in is by email and password, and signing in with a Google or GitHub account is not offered for your app's users today. The checks are not a security audit. They cannot tell whether your app's own rules, such as who may book which slot, are the right ones. That part is still yours to describe and your agent's to build.

To start an app this way, paste this into your coding agent:

nerdsystem is free to start, no card. The sign-in email the agent sends creates your account; there is no password and no sign-up form.

If the app already exists

An app built elsewhere keeps its screens. The server side and the sign-in are rebuilt on the platform's, and your existing users sign up again, because passwords cannot be moved between systems. The compare pages say what that means for each tool, and the guides walk through a new app with each agent.