Manage users

Once sign-in works, you'll need to help people join your app and manage their accounts. Use the saaslayer CLI or the Users API with an account authorized for those operations.

The commands below target a deployment called dev. Replace it with your environment or deployment ID. These examples change real accounts when you run them; use your development deployment while learning.

Sign in to the right deployment

saaslayer login --deployment dev

This logs in to your app's Users service. It is separate from saaslayer login, which logs you in to SaaSLayer itself. Your account needs the appropriate Users permissions for the commands you're about to run.

Look up an account

saaslayer users get --email teammate@example.com --deployment dev
saaslayer users list --email teammate@example.com --deployment dev

The output includes the account's ID and available account details. Use the stable user ID when your app needs to refer to that person; names and email addresses can change.

Create an account with an invitation

saaslayer users create --email teammate@example.com --delivery invitation --deployment dev

This uses the deployment's account-creation and invitation flow. The deployment must have that flow configured. The invited person follows the registration steps to establish their account and then signs in.

Creating an account does not, by itself, define all the person's access to your app's teams and data. Assign membership and roles through your access model.

Update a profile

saaslayer users update --email teammate@example.com --name "Maya Chen" --deployment dev

Ordinary profile updates are separate from changes to identity or reserved attributes. For example, changing an email address or its verification status requires additional authority; don't treat it as a display-name update.

Disable and re-enable an account

saaslayer users disable --email teammate@example.com --deployment dev
saaslayer users enable --email teammate@example.com --deployment dev

Disabling an account stops sign-in and triggers sign-out; it keeps the account's grants and credentials. Re-enabling lets the person sign in again. Existing tokens have enforcement and expiry limits, so it isn't a substitute for verifying sessions on your backend. Safeguards refuse changes that would remove the last usable administrator or owner where that protection applies.

Help someone recover access

saaslayer users reset-password --email teammate@example.com --deployment dev

The deployment's recovery flow sends the person the next step. Avoid setting a shared password or putting administrator credentials in a browser app. MFA recovery is a separate administrative operation; it isn't the same as a password reset.

Add team roles when you need them

For a project tracker, a team owner might invite members while a viewer can only read projects. Model those rules in Permissions and enforce them in the backend that owns the protected data.