How to Add User Login to an App Built With AI

Your AI-built app works. It runs locally, does the thing you described in plain language, and looks close to what you pictured. Then someone asks the question that ends the demo phase: "can people sign in?" Login is where a lot of vibe-coded projects stall, because auth touches security, and security is the one area where confident-sounding wrong answers cause real damage.

The good news: adding authentication is mostly choosing from a short menu and briefing your agent precisely. The rule that matters more than any implementation detail: never hand-roll the cryptographic parts.

Pick your rung on the auth ladder

Work your way up this list and stop at the first option that fits:

Magic links are the gentlest start. The user enters an email, receives a link, clicks it, and they're signed in. No passwords exist, so nothing can be leaked or forgotten. Great for internal tools, waitlists, and early products where friction matters more than convention.

Email and password is what users expect, which is exactly why it carries obligations: hashing passwords properly, handling resets, rate-limiting attempts, confirming emails. If you need it, use a vetted library for every one of those pieces.

Social sign-in (OAuth) lets people log in with an existing account from a major provider. Familiar and quick for users, but it means registering an app with each provider, wrangling redirect URLs, and deciding what to do when someone has accounts with two providers.

Hosted auth services sit above all of these and bundle them: prebuilt sign-in screens, session management, password reset flows, and dashboards, exposed to your app through a library. For most AI-built apps this is the pragmatic answer — you trade a bit of flexibility for not owning the riskiest code in the product.

What you never build yourself

Say it plainly: password hashing schemes, session token generation, encryption choices, and password-reset token flows are not DIY projects. The failure modes are invisible until they're catastrophic, and getting them wrong doesn't produce a bug report — it produces a breach. Every mainstream language has battle-tested libraries for this; every serious product uses a hosted provider or those libraries. Tell your agent explicitly: "use the standard, well-maintained library for this — don't implement crypto yourself." A good agent will agree enthusiastically; a vague prompt is what tempts it to write something clever.

The exact asks that get you working middleware

Vague prompts produce half-wired auth. Ask for the specific moving parts:

• "Add [chosen auth approach] with the official library for my framework. Create sign-up, sign-in, and sign-out routes."
• "Add authentication middleware that protects everything under /dashboard and redirects unauthenticated visitors to /login, remembering where they were headed."
• "Set sessions to expire after [your timeframe] of inactivity, and handle expiry gracefully — redirect to login rather than showing an error."
• "Store session state properly for a server-rendered app / a client-side app" — say which yours is, because the answer differs.
• "Show me every file you changed so I can review it."

Then test like a skeptical stranger: open a protected page in a private window while logged out, let a session expire mid-task, try the back button after signing out.

Auth rarely arrives alone — it usually sits on top of stored data, and our guide to adding a database to an AI-built app pairs naturally with this one. If login exists to gate content or perks, building a membership site with AI covers that pattern end to end, and once it all works locally, deploying an app built with AI gets it onto the internet.

meshcode fits this kind of careful, multi-step wiring well: panes run side by side on Mac and Windows, so the agent implements auth in one while you keep the app running and testable in another, and every change lands as ordinary files you can review before anything ships. Start with an existing subscription or meshcode's metered models.

👉 Download meshcode — Mac, Windows