App Authentication: Login You Can Reset Without SSH

Authentication is accounts, roles, and a reset path your operator can run without SSH. A library name on a slide is not a login. If only we can unlock a user, you do not operate the product.

CodeLoop Studio in Sarajevo builds that into web apps and mobile products. A logged-in daily tool is web app development. Pipeline software is custom CRM. Hena Em is reservations and vehicles — staff log in, permissions matter, the owner is not waiting on us for a password.

Sessions, not a magic SDK

We pick the stack after the threat model: email magic link, password, SSO if you already have an IdP. We will not drop an open-source “locker” into a client app because a conference talk used that word. You keep the user table. Tokens expire. Refresh is boring on purpose.

SaaS with more than one tenant is a different freeze — SaaS development agency. A marketing site with a password field is still a brochure. We will say so.

What we freeze

• Roles before UI. Sales does not see every record. That drawing happens in discovery, not as a toggle in week twelve.

• Admin reset. Someone on your side can unlock an account. If the only path is our laptop, the engagement model failed.

• Your IdP when you have one. We will not invent a second password database because it was faster to sketch.

• No “blockchain login.” If the brief is a wallet for its own sake, read when not to build blockchain. Most businesses need a session, not a public ledger of who signed in.

Legacy logins

Taking over a product where the previous vendor is the only admin is a takeover first — legacy project takeover. We will not clone credentials we cannot rotate.

Send who must get in

Roles, whether you already have Google or Microsoft login, and who resets a lockout at 7:00. Reply in 24 hours — online estimate or contact.