Sign-in options
Use the authentication options offered for your app. Describe the audience and whether accounts should be open to new users or limited to invited people. Confirm the actual methods and configuration in Studio before publishing a sign-in promise.
Test the complete journey
Section titled “Test the complete journey”Create a test account, sign out, and sign back in. Check where the user lands and which records they can see. If the app offers password recovery or external account sign-in, try that path too.
Test the published hostname separately. An account experience working in preview does not prove that its redirects and sessions work on a custom domain.
Keep access separate
Section titled “Keep access separate”Signing in identifies a person. The app still needs explicit rules for private records, administrative actions, and the context supplied to models. Avoid putting credentials or secret keys into app prompts, client-side code, or support screenshots.