ioy.aiAccounts included in the starter
Configure and test the account system you will ship with your product.
What is included
The reference account flow supports verified email/password, reset by email code, Google OAuth, One Tap, explicit login-method binding, session controls and TOTP. Email/password needs a configured authentication secret; Google and real sending need their own setup.
First local account
Follow the demo walkthrough. Passwords have a minimum of 10 characters. Read the simulated code with mail:local; do not expect a message in a real inbox in default local mode.
Connect real accounts
Follow service configuration. Match browser origin and APP_URL, Google redirect URI, sending domain and Turnstile keys. Use an isolated preview identity to test new signup, existing login, reset, explicit linking and revoked sessions.
Protect administration
Set ADMIN_EMAILS to your actual administrator emails. Enable TOTP in Account, save recovery codes privately and use a recent session; non-local dashboard access requires two-factor setup and a session created within 15 minutes. API keys do not grant admin access.
Explain data handling accurately
The generated product must describe actual account export, deletion conditions and financial-record retention. Do not treat the reference policy draft as a reviewed policy for every business. Continue to configuration or troubleshooting.