AUTH GUIDE / Scenario guide
A company of their own
Start with a free workspace or trial
Bruno starts a workspace for his small company without paying first.
A worked example with fictional people and products.
What this gives you
Verified signup earns the starting workspace.
A free account and a usable free plan are separate pieces. Configure both.
Jump to the implementation recipe ↓See it happen
Follow Bruno’s first day
- 01
Create the login
Bruno signs up from the product.
What happens behind this step
Use the customer client with AllowSelfRegistration and SignupGrantsAccount enabled.
- 02
Verify the email
The verification earns the right to open a workspace.
What happens behind this step
Verified signup creates an owner grant. A submitted form alone is insufficient.
- 03
Open his workspace
Bruno signs in as the owner of his company’s account.
What happens behind this step
Redeem the signup grant at login. The customer access token names that account.
- 04
Use the starting plan
The app gives Bruno the capabilities of the configured free plan or trial.
What happens behind this step
Configure FF License separately. FreeTier in auth is a declaration, not a license policy. For a trial, use trial_grant with the matching configured policy.
- 05
Grow later
The product can offer an upgrade from this starting point.
What happens behind this step
Implement and verify the entitlement transition in the product’s billing flow; authentication alone does not perform an upgrade.
The handover to your app
A person, a context, a clear boundary.
Bruno enters as owner.
Use Bruno’s company account to decide which records this request may reach. The product still checks what this person may do.
{
"sub": "bruno-example-id",
"account": "selected-company-id",
"account_role": "owner"
}Build this scenario
The recipe for your developer or agent.
Start with a registered customer app and the policy below. Then connect the specific access path for this scenario.
1. Register the app
Choose your organization and environment, register the HTTPS callback, then configure the client ID and server secret.
Registration request and prerequisites →2. Apply this access policy
{
"surface": "customer",
"allowSelfRegistration": true,
"signupGrantsAccount": true,
"freeTier": "default_plan"
}Use default_plan for the worked example and configure its actual license policy. For a trial, replace it with trial_grant and set the corresponding trial policy.
3. Connect hosted sign-in
The app starts login, auth handles the hosted screens, and the validated callback brings the person back to your product.
Complete .NET example →OIDC for other stacks →
4. Check the boundaries
A free account and a usable free plan are separate pieces. Configure both.
Acceptance checks →Branding and direct return →
Ready-to-use implementation brief
Give this brief and this page’s URL to your developer or agent. Replace the example account and callback values with the approved settings for your app.
Implement the start with a free workspace or trial scenario for a new app using ALKEYON.
Use the customer client policy below in the selected environment.
Register the exact HTTPS app callback and keep confidential credentials server-side.
Use default_plan for the worked example and configure its actual license policy. For a trial, replace it with trial_grant and set the corresponding trial policy.
Keep the hosted login, verification and recovery flow tied to this app.
Validate tokens and enforce the tenant, account and operation boundaries.
Do not treat a successful login as a payment or membership grant.
Use the current SDK and OpenAPI contracts linked in this guide.
Verify permitted entry, refused entry, correct product return and revoked access.
Client policy:
{
"surface": "customer",
"allowSelfRegistration": true,
"signupGrantsAccount": true,
"freeTier": "default_plan"
}