# Notes with sign-in and private attachments

> Combine app-owned authentication, D1 and private R2.

- Canonical page: https://docs.userland.fun/quickstarts/full-stack-app/
- Docs index for agents: https://docs.userland.fun/llms.txt

> **For agents:** Read the [complete native guide](/native-guide.md) and current `context.get` capabilities. Use only implemented operations and preserve exact Account, app and environment authority.

The selected native-notes reference uses a standard Worker, D1 tables, a private R2 bucket and an app-owned session-signing secret. It supports sign-up/sign-in, server-side logout, notes and authenticated private attachments. It imports no Userland runtime SDK.

Declare logical D1 and R2 bindings in `wrangler.jsonc`; request a generated `SESSION_SECRET` through `secret_requirements`. The platform resolves separate owned resources for preview and production. Code redeploys retain their data and secret revisions unless an explicit authorized action changes them.

The reference uses a host-only `__Host-` session cookie, exact Origin checks for writes and per-user authorization for each saved record/file. Do not remove these guards because the gateway also enforces a browser boundary.

Apply to preview, test sign-in, create/reload notes, upload/read/delete a file and verify that a second user cannot access it. Use the exact preview generation for browser tests. See [Authentication](/guides/auth/), [Data](/guides/data/) and [Files](/guides/files/).