Users and Access

Heisenware provides granular control over who can access your Apps. Each App can have distinct security settings, even if they reside within the same Workspace.

Users vs. Members

This article covers the Users of your Apps. For managing your Members, the people who build and manage your Apps, see Members.

Access modes

In the Apps panel, you can choose from five distinct access options to match your security requirements.

While you can change these settings at any time, doing so will instantly affect all active sessions. Frequent changes may confuse your Users.

Public access

• Option: Anyone can use the app

• Details: The App is open. Anyone with the URL or QR code can access the interface immediately. No login is required.

Shared security

• Option: Users must provide a master password

• Details: You must define a master password in the settings.

• Session: Authentication is stored in the browser's local storage. Users are only prompted to re-enter the password if they use a different device, an incognito window, or clear their browser data.

Individual registration

• Option: Users have to sign up

• Details: Heisenware manages user accounts automatically. Users can register with an email/password or their Google account.

• Session: Like the master password, login state is persistent in local storage. Users remain logged in until they manually log out or clear their browser cache.

Dual authentication

• Option: Users have to sign up and provide a master password

• Details: Combines the previous two methods. Users must have a personal account and know the shared master password to gain entry.

Private whitelist

• Option: Only previously invited users can log in

• Details: This opens an email invite form. Only the specific email addresses you invite can register and access the App.

• Programmatic Invite: Using the users class in the backend, you can also invite Users programmatically from another App.

User management

The Users card within each App provides a real-time view of who is accessing your software.

Managing Users programmatically

You can also manage Users from within an App using the users class.

Anonymized sessions

For Apps using Public Access or Shared Security, the table displays anonymized strings, IP addresses, and session data to help you track unique device usage.

Registered profiles

For Apps using Individual Registration or Dual Authentication, the table displays names and usernames (email addresses). Users who log in from different devices with the same email are correctly recognized as the same individual.

Deleting Users

You can manually remove Users, both registered accounts and anonymous sessions, directly from the list by clicking the trash icon. Deleting a User removes their record and terminates their current session.

Leveraging User data in logic

Once a User is authenticated, their information is automatically available in the Backend Builder via the $USER system variable. You can use this variable to personalize the UI (e.g., "Welcome, [Name]"), filter database queries so Users only see their own data, or log exactly who performed a specific action in your backend.

For example, if a table stores each row's owner in an email field, a getTableData Function can filter for the logged-in User's own rows:

# name
orders
# options
filter: ['email', '=', $USER]