Users

The user directory

Each app has its own users. A user has an ID (usr_…), an email address, a phone number or both, an optional name and metadata, and their sessions, passkeys and sign-in history. Users are created when they first sign in or accept an invitation. There’s no API to create users or sessions, or to sign in as a user.

Two users of the same app never share an email address or phone number, and accounts are never merged automatically. Changing a user’s email or phone through the API notifies them at the old address or number and is written to your audit log.

View users in the dashboard’s Auth section, or read and change them with an API key that has the auth_users permission (API reference).

Blocking

Blocking a user ends all their sessions at once and stops them signing in. Your app finds out at its next refresh, which fails with invalid_grant, or sooner from the user.blocked and session.revoked webhooks. Unblock them to let them back in.

Deleting

Deleting a user removes them with their sessions and passkeys, and sends user.deleted. It can’t be undone.

Users flagged as likely bots don’t count toward your plan. Delete them all at once from the dashboard or the API.

Sign-in history

Every sign-in attempt is kept for 90 days, with its time, method, result, the reason for a block, IP address, network, approximate city and region, device and risk level. Blocks from HonkIO’s platform blocklist show as “blocked by HonkIO”. See it per user in the dashboard, or with GET /v1/auth-apps/:id/sign-ins.

Export

Export all of an app’s users, organizations, roles and passkey public metadata as a JSON file, at any time. In the dashboard, starting an export asks you to confirm with a passkey or a code sent to a second channel. The file is built in the background; when it’s ready, you get a single-use download link that expires after 15 minutes. Every export is written to your audit log.

The file never contains sessions, refresh tokens, codes or signing keys. Passkeys themselves can’t move to another provider, by design; users add them again there.