> ## Documentation Index
> Fetch the complete documentation index at: https://docs.newly.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in for your app

> Add email, Google or Apple sign-in to the app you build, using Newly Backend.

This page is about sign-in for **your app's users**. To sign in to Newly v2 itself, see [Sign up and sign in](/get-started/sign-in).

## Email and password

Ask the agent for accounts, for example: "Let people create an account with email and password and keep their notes private."

The agent adds [Newly Backend](/backend/overview) if your app doesn't have it, then builds the sign-up and sign-in screens. Setting up a backend needs credits in your balance. Email and password sign-in works as soon as the backend is set up. There's nothing to configure.

Test it in your preview by creating an account, signing out and signing back in.

## Google and Apple sign-in

Google and Apple sign-in need credentials from your own Google or Apple developer account. Newly doesn't provide ready-made test credentials, so these buttons won't work until you add yours.

<Steps>
  <Step title="Create the sign-in credentials">
    For Google, create an OAuth client in Google Cloud. For Apple, set up Sign in with Apple in your Apple Developer account. Each provider gives you a client ID and a client secret. For Apple, the client secret is a signed token you create from a key in your Apple Developer account.
  </Step>

  <Step title="Add them to the sign-in service">
    Set the values as secrets on the **auth** service of your dev backend, using the newly CLI:

    ```bash theme={null}
    newly secrets set GOOGLE_CLIENT_ID <value> --service auth
    newly secrets set GOOGLE_CLIENT_SECRET <value> --service auth
    ```

    For Apple, use `APPLE_CLIENT_ID` and `APPLE_CLIENT_SECRET`. Always include `--service auth`. The default service doesn't work.
  </Step>

  <Step title="Redeploy the backend">
    Secrets take effect on the next deploy. Ask the agent to redeploy your dev backend. If you deploy yourself with `newly deploy --env dev`, run `newly pull` first, because the command deploys the `backend/` folder on your computer.
  </Step>

  <Step title="Ask the agent to add the buttons">
    For example: "Add Sign in with Apple and Google sign-in." The agent adds the Apple button first, because the App Store expects Sign in with Apple when an app offers other social sign-in options.
  </Step>
</Steps>

Don't paste client secrets into the chat. The agent declines them. See [Production and secrets](/backend/production-and-secrets) for how to install the tool, sign in and work with secrets.

<Note>
  The newly CLI sets secrets for dev. For production secrets, including Google and Apple credentials for your released app, contact support.
</Note>

## Emails for password reset and verification

Newly Backend doesn't set up email sending. Password reset and email verification messages won't go out until your app has an email provider.

If your app needs a forgot-password flow or email verification, ask the agent to add an email provider. You'll need an account with that provider and its API key, which you set as a secret on your backend.

## Sign-in from a website you own

Sign-in already works from your previews and from your app on a phone. You don't need to change anything for that.

If your app also runs as a website on a domain you own, the sign-in service has to trust that address. Add just that one address to the `TRUSTED_ORIGINS` secret on the **auth** service, then redeploy. Never set it to `*`, which would let any website sign your users in.

<Warning>
  Don't set the keys the platform manages, such as `DATABASE_URL`, `BETTER_AUTH_SECRET`, `JWKS_URL` or anything starting with `NEWLY_`. Setting `BETTER_AUTH_SECRET` signs out every user of your app.
</Warning>

## Screen order with sign-in and a paywall

When your app has sign-in, onboarding and a paywall, the agent puts them in a fixed order:

1. Sign-in
2. Onboarding
3. Paywall
4. Home

A paywall before sign-in would tie purchases to nobody, so the agent keeps this order even if you ask for a different one.

## Related

<CardGroup cols={2}>
  <Card title="Data, accounts and Newly Backend" icon="server" href="/backend/overview">
    What Newly Backend includes and when the agent adds it.
  </Card>

  <Card title="Production and secrets" icon="key" href="/backend/production-and-secrets">
    Deploy to production and manage API keys.
  </Card>
</CardGroup>