# App-owned authentication

> Keep app visitors separate from Userland Account membership.

- Canonical page: https://docs.userland.fun/guides/auth/
- Docs index for agents: https://docs.userland.fun/llms.txt

> **For agents:** Read the [complete native guide](/native-guide.md) and current `context.get` capabilities. Use only implemented operations and preserve exact Account, app and environment authority.

Your Worker owns its authentication implementation, users, roles and sessions. Userland Account roles authorize platform operations; they are not roles inside your app. There is no platform app-user invitation or universal app-session API in the native contract.

On shared Userland addresses use host-only `__Host-` session cookies with `Secure`, `HttpOnly`, `Path=/` and no `Domain`. Check the exact Origin for state changes and apply server-side authorization to every record and file. Reject duplicate or ambiguous cookie values, and invalidate sessions on the server when signing out. SameSite alone does not isolate sibling apps.

Request generated app secrets through typed requirements and preserve them across ordinary redeploys. The native-notes reference demonstrates these boundaries; password recovery, email verification and abuse controls remain deliberate app features. See the [native guide](/native-guide.md).