FAQ

← Developer Docs · Core Concepts · API Reference

Do users need to create a password?

No. Phuze uses magic links — a one-time sign-in link sent to the user's email. There are no passwords to create, remember, or reset.

What happens if a user opens the magic link on a different device?

The session is created on whichever device clicks the link. If the user requested the link from a desktop but clicked it on mobile, the mobile device gets the session. The desktop tab polling for the session will not see it (sessions are browser-specific). The user would need to request a new link from the desktop if they want both devices logged in.

Can I access user data beyond email?

In Stage 1, Phuze stores email only. Display names, profile photos, and additional fields are on the Stage 2 roadmap.

Can I use Phuze with multiple domains?

Yes. Add all your domains via PATCH /api/v1/clients/me (CLI: phuze domains add (WIP)). All domains share the same quota and user pool.

What if I hit my daily login quota?

Upgrade for a higher daily quota (see phuze.edato.me/pricing) — paid plans also accept overage past the quota up to a hard cap. MAU is not a plan limit, so returning users never count against you; contact us if you need higher limits.

Is the session token a JWT?

No. Session tokens in Stage 1 are opaque strings. JWTs (for offline verification without an API call) are a Stage 2 feature.

Can the widget be used without the built-in UI?

Yes, two ways. (a) Keep the widget for the login flow but build your own app UI: call Phuze.init() + Phuze.mount() and use Phuze.getSession() / Phuze.onSessionChange() for your own components. (b) Skip the widget entirely and drive the backend directly — see the custom login flow for the full recipe (magic-link request → pending_id polling → verify), including the security invariants you must carry that the widget otherwise handles for you.

Phuze · phuze.edato.me · Developer Docs · API Reference