Bubble.io Authentication: User Accounts, Login, and Signup Explained
Authentication is built into Bubble natively — no Auth0 or external service needed. Complete signup and login workflow code, social login with Google, page-level authentication guards, and the FAQ covering password reset, email verification, and 2FA.
How User Accounts Work in Bubble.io
Authentication — the system that lets users create accounts, log in, and have their identity verified across sessions — is built into Bubble.io natively. You do not need to install a separate authentication plugin or use an external service like Auth0. Bubble’s User data type, built-in signup and login workflows, and session management handle everything a standard web application requires. This guide explains how authentication works in Bubble and how to implement it correctly.
What Bubble Provides Out of the Box
User Data Type
Bubble creates a User data type automatically in every app. It includes email (required, unique), password (hashed, never visible), and Created Date. You add additional fields: name, profile photo, preferences, and any other user attributes your app needs. The User data type is the foundation of authentication.
Secure Password Handling
Bubble handles password hashing automatically using bcrypt. Passwords are never stored in plain text and never accessible through Bubble’s Data API or workflow expressions. Password reset is handled by a built-in email flow with secure tokens.
Session Management
When a user logs in, Bubble creates a server-side session and stores a session cookie in the browser. ‘Current User’ in any workflow or expression refers to the authenticated user. Sessions persist across browser tabs and page navigations. Sessions expire after a configurable period of inactivity.
Signup, Login, and Logout
Step 1
: Sign the user up
email = Email_input’s value
password = Password_input’s value
name = Name_input’s value
Step 2
: Only when Step 1 succeeded
Log the user in (email + password)
Step 3
: Navigate to /dashboard
// Login page workflow (when Log In button is clicked)
Step 1
: Log the user in
email = Email_input’s value
password = Password_input’s value
Step 2
: Only when Step 1 succeeded
Navigate to /dashboard
Step 3
: Only when Step 1 failed
Show element Error_message: ‘Email or password incorrect’
// Logout workflow (when Log Out button is clicked)
Step 1
: Log the user out
Step 2
: Navigate to /login
Adding One-Click Authentication
Social login (signing in with Google or Apple) significantly improves signup conversion rates. Users do not need to create and remember a new password. Implementation requires installing the official Google / Social Login plugin from Bubble’s marketplace.
Step 1
: Login with Google
Step 2
: Only when Step 1 succeeded AND Current User’s is_new_user = yes
Create linked resources (workspace, profile) for new users
Step 3
: Navigate to /dashboard
Protecting Pages That Require Login
Page load workflow
Trigger
: Page is loaded
Only when
: Current User is not logged in
Action
: Navigate to /login
// This prevents unauthenticated users from accessing the page
// Even if they type the URL directly
// Without this, the page loads briefly before redirecting
// Hide the page content conditionally while redirect is pending
Q: Can I require email verification before login?
Yes. Enable ‘Confirm email’ in Bubble’s Settings. When a user signs up, Bubble sends a verification email. The user cannot log in until they click the verification link. Add this for any app handling sensitive data.
Q: How do I implement two-factor authentication?
Use a TOTP plugin (Time-based One-Time Password) from Bubble’s marketplace. When enabled, the user enters their password and then enters a six-digit code from an authenticator app. 2FA adds significant friction; reserve it for admin accounts or for apps handling very sensitive data.
Q: What happens if a user forgets their password?
Add a ‘Forgot password’ link to your login page. When clicked, navigate to a reset page that asks for the user’s email and triggers Bubble’s built-in ‘Send password reset email’ action. Bubble handles the secure reset token and email automatically.
Build Your Bubble.io App With Expert Help
Pakistan’s leading Bubble.io development team. Multi-tenant SaaS architecture, Stripe billing, and full product builds done right from day one.
