Users

Users are the people who access your application. Each user has credentials, a membership status, and optional device restrictions.

Credentials Types

Authgate supports two types of user credentials:

Username/Password Users

• Traditional sign up and login with username and password
• Password can be changed
• Users can extend their membership with a new license code

License Code Users

• Sign up and login using a Credentials License
• Credentials can’t be changed
• The membership is active until the license expires

Membership Status

Every user has a membership that can be either:

• Active - User can access your application
• Inactive - User is blocked from accessing your application

Memberships can be:

• Time-based - Active until a specific date/time
• Lifetime - Active forever

Users can also have separate memberships for add-ons. Only the main membership decides whether a user can log in.

Adjusting Memberships in Bulk

You can select multiple users and adjust their memberships at once:

Membership:

• Choose Main membership or an add-on to adjust

Duration Adjustments:

• Extend - Add time to memberships (e.g., “3d 4h 30m” = 3 days, 4 hours, 30 minutes). Useful for compensating downtime or giving bonuses
• Reduce - Subtract time from memberships (useful for refunds or corrections)

Lifetime Access:

• Grant Lifetime Access - Make memberships permanent for selected users
• Remove Lifetime Access - Revoke lifetime status and revert to time-based

Optional Reason:

• Add a note explaining why you’re making this adjustment (helps with record-keeping)

Important:

• You can’t extend/reduce duration and grant lifetime at the same time
• You can’t grant and remove lifetime access simultaneously
• Users who already have lifetime can’t be upgraded further (unless you remove their lifetime first)

Device Restrictions

Control how many devices a user can register:

• Number of Devices - Maximum number of devices this user can register
• Number of Simultaneous Sessions - Number of devices that can be logged in concurrently

When device authentication is enabled, users register their device (identified by hardware ID) automatically during sign-up, login, or license activation. This prevents account sharing and ensures user accounts are used on authorized devices only.

Unregistering All Devices in Bulk

On the Users page, select the users, click Unregister all devices, then click Confirm. This removes all registered devices for the selected users and ends active sessions on those devices.

Changes may take a moment to appear. Users can register devices again when they next log in, up to their allowed device limit.

Managing Active Sessions

Select your application and open Sessions in the dashboard to see current sessions across all users.

Each session shows:

• The device hardware ID and IP address
• The authentication method
• When the session started and when it expires

Click a user in the overview, or open Users and select them, to manage their sessions. Click Revoke to immediately end one session and log that user out. To end every session for the user, select Revoke all sessions from the user actions.

Revoking sessions does not prevent the user from logging in again. Use a timeout or ban if you also need to block new logins.

Activity Logs

Each user’s Activity timeline shows logins, device registrations, new IP addresses, and file downloads. See Activity Logs for details.

IP Address Tracking

Authgate automatically tracks all IP addresses that users connect from. This information:

• Powers the automatic cross-ban protection system
• Is displayed in the user details page for admin reference
• Updates automatically every time a user makes an authenticated request

IP addresses are tracked with a “last seen at” timestamp to show when each IP was most recently used.

Banning Users

You can ban users to immediately block their access to your application. See the Ban System documentation for details on how banning works and its automatic protection features.

Timing Out Users

You can also time out a user to block access temporarily without banning them or changing their membership.