Introduction
Q&A
Answers to the questions people actually ask before and while integrating secureFlows — short, plain language, with a link to the fuller page when there is more to say.
Jump to a question
- What is secureFlows?
- What is the secureFlows MCP server?
- Do I need to already know how to code?
- What’s the difference between a workspace and an application?
- How do my users actually sign in?
- I don’t know my app’s URL yet — what redirect URI do I use?
- Can one workspace power more than one app?
- What happens when a session expires — do users lose their data?
- Is one user’s data really invisible to other users?
- How do I sign a user out?
- How do people join my workspace as team members?
- Where do I see who is using my app?
- What happens if I don’t pay before a paid period ends?
- How can I review my current user management status?
- Is data encrypted?
- Can admins in my workspace see end users’ private data?
- This didn’t answer my question — now what?
Getting started
What is secureFlows?
A hosted sign-in screen plus private, per-user storage for your app — so you do not have to build login and a data security model yourself. See What is secureFlows? for the full explanation.
What is the secureFlows MCP server?
A hosted Model Context Protocol endpoint for AI coding agents. Point Cursor (or any MCP client) at
https://www.secure-flows.com/mcp so the agent can build correct login/logout URLs, lint an
integration, and call documented APIs without memorizing every anti-pattern. See
The secureFlows MCP server.
Do I need to already know how to code?
No. You can hand the integration to an AI coding tool (Lovable, Base44, Cursor, Claude Code, and similar) with a short prompt, and it writes the sign-in and storage code for you. You can also write it by hand if you prefer. Both paths are covered in the Integration Walkthrough.
My app already stores data on the device with no accounts — can I still use secureFlows?
Yes — whether that store is browser storage or a local mobile database. Add hosted login, make secureFlows the durable store, and migrate each device’s local data once after the first successful sign-in. See Integration from a local-only app for the recommended prompts and pitfalls (especially dual-writing forever and overwriting cloud data with a stale local snapshot).
What’s the difference between a workspace and an application?
A workspace is your account-level container — it holds your users, applications, and settings. An application is one product inside that workspace. One workspace can hold several applications, each kept separate, so a second product does not mean starting over.
Building your integration
How do my users actually sign in?
Your app sends them to a sign-in screen secureFlows hosts — you never build a login form. After they sign in, their browser is redirected back to a URL you registered, carrying a session token your app then uses for every following request. The full step-by-step sequence is in what actually happens when a user signs in.
I don’t know my app’s URL yet — what redirect URI do I use?
The default is your app’s public address plus /callback. If you are on an AI builder
preview sandbox (Lovable, Base44, and similar) where that host is not obvious yet, follow
Finding the correct redirect URL — secureFlows will
show you the exact URL to allowlist on your first sign-in attempt.
Can one workspace power more than one app?
Yes. Register a second application in the same workspace instead of creating a new workspace — each application gets its own ID and redirect URIs, and end-user data stays scoped to the application that created it.
Sessions & data
What happens when a session expires — do users lose their data?
No. An expired or missing token means “sign in again,” not “data lost.” Sending the user back through hosted login gets them a fresh token for the same underlying session, with everything they saved still there.
Is one user’s data really invisible to other users?
Yes — storage is scoped automatically to whoever is signed in. There is no shared table to filter and no per-user query logic to write on your side; the session token itself is what determines whose data a request can see.
How do I sign a user out?
In a browser app, send the user through the hosted logout: a full-page redirect to
/api/v1/auth/logout with their session token and a redirect_uri back to your app
(the SDK’s logoutWithRedirect does this). That invalidates the token and clears the
hosted-login cookie, and the user’s stored data stays, so their next sign-in brings it back.
Non-browser clients (server-side, CLI, native) call POST /api/v1/auth/logout instead.
Do not use revoke to sign someone out. Revoke permanently destroys the session and everything stored in it, so it is only for when a user or an admin deliberately wants a session deleted. See Authentication & Authorization.
Team & workspace management
How do people join my workspace as team members?
Admins create an invite in Workspace Management and share the activation link. The invited person signs in and is added with the role the invite specified — this is separate from your end users signing in through hosted login, and is only for people managing the workspace itself.
Where do I see who is using my app?
The Sessions and Analytics tabs in Workspace Management show activity — counts, session detail, and per-app breakdowns. If self-service is enabled, end users can also see and manage their own sessions directly, without you building that page.
What happens if I don’t pay before a paid period ends?
End-user session access enters a grace lock until you downgrade to the free plan yourself — cancelling only stops auto-renewal, it does not downgrade automatically. Owners can still list and revoke sessions during the lock. See Billing & Usage for the full mechanics.
Security
How can I review my current user management status?
Paste one prompt into the AI coding tool you already use (Claude Code, Cursor, Codex, or similar), or run
/secureflows:security-review if you use the secureFlows Claude Code plugin. It inspects how your
app handles accounts, sign-in and permissions, lists the security gaps it finds with the file each one was
found in, says which of them secureFlows would close and which stay yours to fix, and writes a migration
plan. It is read-only: nothing in your code changes, and you need no secureFlows account. Like any AI
review it can miss things or get details wrong, so check each finding against your code. Start with
Security review of your user management.
Already on secureFlows? In the Workspace Manager, Users shows who belongs to your workspace and their roles, Sessions shows live sessions, Analytics shows usage against your plan, and Security shows the audit log and API access log. See Where do I see who is using my app?
Is data encrypted?
Yes — payload is encrypted with workspace-level keys before it is stored. What lands on disk, and in backups, is ciphertext. See Platform Architecture for the full data-flow breakdown.
Can admins in my workspace see end users’ private data?
Workspace admins and owners can read decrypted payload through the API when their role allows it — that is an explicit, intentional operator capability, and every such read is audit-logged. It is not a gap in the isolation model between end users.
Getting more help
Three ways to go deeper: search the docs directly, ask the Support Bot a plain-language question grounded in these same docs, or reach a person via Contact.