Introduction
Q&A
Answers to the questions people actually ask before and while integrating secureFlows — short, plain language, with a link to the fuller page when there is more to say.
Jump to a question
- What is secureFlows?
- Do I need to already know how to code?
- What’s the difference between a workspace and an application?
- How do my users actually sign in?
- I don’t know my app’s URL yet — what redirect URI do I use?
- Can one workspace power more than one app?
- What happens when a session expires — do users lose their data?
- Is one user’s data really invisible to other users?
- How do I sign a user out?
- How do people join my workspace as team members?
- Where do I see who is using my app?
- What happens if I don’t pay before a paid period ends?
- Is data encrypted?
- Can admins in my workspace see end users’ private data?
- This didn’t answer my question — now what?
Getting started
What is secureFlows?
A hosted sign-in screen plus private, per-user storage for your app — so you do not have to build login and a data security model yourself. See What is secureFlows? for the full explanation.
Do I need to already know how to code?
No. You can hand the integration to an AI coding tool (Lovable, Base44, Cursor, Claude Code, and similar) with a short prompt, and it writes the sign-in and storage code for you. You can also write it by hand if you prefer. Both paths are covered in the Integration Walkthrough.
What’s the difference between a workspace and an application?
A workspace is your account-level container — it holds your users, applications, and settings. An application is one product inside that workspace. One workspace can hold several applications, each kept separate, so a second product does not mean starting over.
Building your integration
How do my users actually sign in?
Your app sends them to a sign-in screen secureFlows hosts — you never build a login form. After they sign in, their browser is redirected back to a URL you registered, carrying a session token your app then uses for every following request. The full step-by-step sequence is in what actually happens when a user signs in.
I don’t know my app’s URL yet — what redirect URI do I use?
The default is your app’s public address plus /callback. If you are on an AI builder
preview sandbox (Lovable, Base44, and similar) where that host is not obvious yet, follow
Finding the correct redirect URL — secureFlows will
show you the exact URL to allowlist on your first sign-in attempt.
Can one workspace power more than one app?
Yes. Register a second application in the same workspace instead of creating a new workspace — each application gets its own ID and redirect URIs, and end-user data stays scoped to the application that created it.
Sessions & data
What happens when a session expires — do users lose their data?
No. An expired or missing token means “sign in again,” not “data lost.” Sending the user back through hosted login gets them a fresh token for the same underlying session, with everything they saved still there.
Is one user’s data really invisible to other users?
Yes — storage is scoped automatically to whoever is signed in. There is no shared table to filter and no per-user query logic to write on your side; the session token itself is what determines whose data a request can see.
How do I sign a user out?
Revoke their session token, discard it on your side, and send them back to hosted login. Once revoked, that token stops working entirely — it is a distinct action from a token simply expiring on its own.
Team & workspace management
How do people join my workspace as team members?
Admins create an invite in Workspace Management and share the activation link. The invited person signs in and is added with the role the invite specified — this is separate from your end users signing in through hosted login, and is only for people managing the workspace itself.
Where do I see who is using my app?
The Sessions and Analytics tabs in Workspace Management show activity — counts, session detail, and per-app breakdowns. If self-service is enabled, end users can also see and manage their own sessions directly, without you building that page.
What happens if I don’t pay before a paid period ends?
End-user session access enters a grace lock until you downgrade to the free plan yourself — cancelling only stops auto-renewal, it does not downgrade automatically. Owners can still list and revoke sessions during the lock. See Billing & Usage for the full mechanics.
Security
Is data encrypted?
Yes — payload is encrypted with workspace-level keys before it is stored. What lands on disk, and in backups, is ciphertext. See Platform Architecture for the full data-flow breakdown.
Can admins in my workspace see end users’ private data?
Workspace admins and owners can read decrypted payload through the API when their role allows it — that is an explicit, intentional operator capability, and every such read is audit-logged. It is not a gap in the isolation model between end users.
Getting more help
Three ways to go deeper: search the docs directly, ask the Support Bot a plain-language question grounded in these same docs, or reach a person via Contact.