Authentication and recovery

Open Configure → Auth for the selected app. Enable only the methods your app implements: email/password, magic links, or supported provider sign-in configured through Integrations.

Redirects and sessions

Allow the exact callback destinations used by your app. Custom app schemes and HTTPS callbacks serve different platforms; verify both success and error handling on the actual target.

Session settings define how long a signed-in device remains trusted. Review inactivity, absolute lifetime, and recent-authentication requirements together. Do not promise immediate recovery or revocation solely because a setting saved successfully.

Recovery test

Use a disposable Test account to verify signup, sign-in, relaunch, password recovery, email changes where configured, and sign-out. Repeat with an expired or revoked session. Check that an unrelated account cannot recover the first account’s data or purchases.

Account deletion

Save an explicit deletion policy and test it before exposing deletion in your app. Credential-only deletion preserves different data from customer deletion. Review profile scrubbing, identity links, and any configured sign-up recovery behavior.

Do not test destructive behavior on real customers. The Agent’s Test-only record-deletion restriction is separate from an app customer’s own configured account-deletion workflow.

Support identity and paid access

Set who can contact Support and whether a reply email or verified identity is required. A support identity is not proof of App Store ownership. Read Paid access before changing access policy.