Documentation
How Kembo handles Google and Apple sign-in, sessions, and the SDK surface in your app.
Kembo supports Google and Apple sign-in across Expo, Flutter, Capacitor, and Web. On the free plan, Kembo hosts OAuth — your app shows Kembo's sign-in UI and users authenticate without you configuring Google Cloud or Apple Developer credentials.
On Pro, you can use your own OAuth credentials and show your app name and logo on the sign-in screen.
useUser() and useAuth().After integration, your app typically uses:
useUser() — profile, email, avatar URL, and provider after sign-in.useAuth() — sign-in, sign-out, and loading state.The exact import path depends on your platform. Follow the setup guide in your project dashboard for copy-paste examples.
Every end user has a role: member (the default) or admin. Roles are per project and control who may manage other users.
useUsers() and the delete helper.Only a project owner can grant the role, from the dashboard Users tab (Make admin / Remove admin). A user can never promote themselves — the role is read server-side from the database, not from anything the app sends, so it cannot be forged.
The signed-in user's role is available on the user object (user.role), so you can gate admin UI in your app, e.g. if (user.role === "admin"). Listing all users from a non-admin client returns 403; for fully server-side access use your secret key with the Node SDK.
The SDK calls GET /api/v1/project with your publishable key to read public configuration — branding mode, which providers are enabled, and whether analytics is on. See the API reference.
If your backend needs to trust Kembo sessions, verify the access token JWT or call GET /api/v1/auth/me with the bearer token. List and manage users from the dashboard Users tab or via the server API with your secret key.