docs: add a User Authentication page for brokered app sign-in - #7046
Merged
Conversation
Documents letting people sign in to a generated app with their Reflex account: adding it, choosing who is admitted, the user list and export, blocking somebody, the sign-in page's presentation, and removing it. Four things the page is careful about, because each is a support ticket if it is left implicit: * **On Free, an app admits anyone with a Reflex account.** Adding sign-in makes an app know who somebody is, not private. Narrowing the audience is the Pro control, so that is said in the plan callout and again as a warning rather than left to be discovered. * **Narrowing signs everyone out**, not only the people it excludes. * **A session lasts at most 7 days** whatever the token lifetimes suggest, because the client stores its renewal credential in a cookie with that ceiling. "30 day refresh token" would be a promise we do not keep. * **A block takes up to 30 minutes** to reach a session already running, since the app re-checks identity on a schedule. The security note tells people to decide what somebody may do in backend code: the frontend can hide a page but cannot keep data out of reach, which is the mistake an agent-built app is most likely to make. Screenshots are captured from the real panel against seeded data.
Contributor
Greptile SummaryThis PR adds comprehensive documentation for brokered Reflex-account authentication in AI Builder and registers the page in the AI Builder sidebar.
Confidence Score: 5/5The PR appears safe to merge with no outstanding correctness, security, or repository-rule issues. The changes since the previous review only tighten explanatory prose without altering its meaning, and both previous findings are fully fixed in the current documentation.
|
| Filename | Overview |
|---|---|
| docs/ai_builder/features/user_authentication.md | Adds the brokered authentication guide; the revisions since the previous review preserve behavior and the previously reported API/import defects are fixed. |
| docs/app/reflex_docs/templates/docpage/sidebar/sidebar_items/ai.py | Registers the new User Authentication page in the AI Builder feature sidebar. |
Reviews (5): Last reviewed commit: "Merge remote-tracking branch 'origin/kha..." | Re-trigger Greptile
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
Merging this PR will not alter performance
Comparing 
Footnotes
|
`auth_user.email` and friends are not a public surface. `auth_user` is the name of the argument an *authorization check* callable receives, and I lifted it out of an internal docstring and presented it as the way an app reads its signed-in user. Apps generated from that would fail on attribute access. The supported interface, per `docs/enterprise/auth/example-app.md` and `reflex_enterprise/auth/user_state.py` (where `User = AuthUserState`): * `User.name` / `.email` / `.sub` / `.picture` are Vars, for rendering. * `await User.current()` returns the claims dict inside an event handler, or `None` when anonymous. Both are shown, split by what the reader is doing rather than listed as one set, since which of the two is correct depends on where the code runs. Anything beyond the common claims wants a computed var on an `AuthUserState` subclass, so the page points at the Authentication guide rather than restating it.
Two unrelated things the same pre-commit run wanted. `ruff-format` also formats python blocks inside docs, and the sample I added in the previous commit was missing the blank line before its decorator. That is why the docs commit before it passed and this branch then went red on a change that touched one markdown file. The lock is stale against `pyproject.toml`, which has declared a `testing` extra since #7008 while `uv.lock` still says `provides-extras = ["db", "pydantic"]` and carries no `extra == 'testing'` entries at all. Nothing in this branch can affect dependency resolution -- it is two docs files -- so this is main's drift surfacing once `uv` began writing the field. Relocked rather than left, since every branch cut from here hits it.
The handler sample called `@rxe.event` without importing `reflex_enterprise as rxe`, so copying it raises `NameError` at import, before the handler could run. The component sample above it had the same flaw and was not reported: `rx.hstack`, `rx.avatar` and `rx.text` with no `import reflex as rx`. Fixed both, since a reader copies whichever one matches what they are doing and neither would have worked. The page's own `python exec` block imports rx for the screenshot calls, which is what hid this: the samples render fine on the page while being incomplete for anyone pasting them into an app.
adhami3310
marked this pull request as ready for review
September 4, 2026 19:54
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
masenf
reviewed
Sep 4, 2026
Per review. "Available on every plan, because being unable to revoke access is worse than being unable to configure it" imported the reasoning behind the decision into a page whose reader only needs the decision. Now just says blocking is available on every plan. Trimmed the same tic from the sign-out paragraph, which explained why the behaviour is what people expect rather than saying what it does.
…' into khaleel/docs-user-authentication
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documents brokered end-user sign-in for generated apps: adding it, choosing who is admitted, the user list and CSV export, blocking somebody, the sign-in page's presentation, and removing it. New page at
docs/ai_builder/features/user_authentication.md, registered in the AI Builder sidebar.The product side shipped in flexgen (#5388 and the tickets under Brokered App Auth); this is the customer-facing half of ENG-11866.
What the page is careful about
Each of these is a support ticket if left implicit, so each is stated rather than implied:
reflex-enterprisestores its renewal credential in a cookie with a 7 daymax_age. Documenting "30 day refresh token" would be a promise we do not keep.The security note tells people to decide what somebody may do in backend code. The frontend can keep a page out of sight but not the data out of reach, and that is the mistake an agent-built app is most likely to make.
Plan wording
Follows
automated_provisioning.mdin naming the tier outright rather than the older "available on supported plans" phrasing. Here the free/Pro split is the shape of the feature, so vagueness would read as sign-in itself being gated, which is the opposite of true.Screenshots
Captured from the real Auth panel against seeded data rather than mocked up, each framed on its own card. The alt text was written first and used as the shot list, so it describes what is actually in each frame.
Assets are live on the CDN and verified by etag against the local bytes.
Checks
pre-commit run --filespasses on both files, and the page renders through the flexdown parser (which is what catches a malformed alert block or table).