Anonymous Users & Upgrading
Start users without a sign-in screen, then link Apple, Google or an e-mail and password to the same user id so their data stays theirs. What happens when the account is already taken, and how abandoned anonymous users are cleaned up.
An anonymous user is a real Abrova Auth user with no credentials of its own: only the device that created it holds its session. Your app can use it right away with every Abrova product, then ask the user to sign in properly later without losing anything.
Why start anonymous#
- No sign-in wall. The user tries your app first. Sync documents, chat rooms and A/B test assignments already belong to a stable user id.
- Security rules from the first screen.
auth.uidis set for an anonymous user too, so rules such asdata.ownerId === auth.uidprotect their data from other users. - Experiments for signed-out visitors. Abrova A/B Testing needs a user token for each user; an anonymous user has one.
Create the anonymous user#
Turn on Anonymous in Abrova Auth › Sign-in methods, then:
if (AbrovaAuth.instance.currentUser == null) {
await AbrovaAuth.instance.signInAnonymously();
}Check for a current user first. The SDK restores the saved session at start; calling signInAnonymously() on every start creates a new user each time. See Anonymous sign-in.
Upgrade: link a sign-in method#
When the user is ready to keep their account, link a method to the signed-in anonymous user. The user id does not change, so everything stored under it stays theirs.
| Call | Links |
|---|---|
| linkApple | Sign in with Apple |
| linkGoogle | Sign in with Google |
| linkPassword | An e-mail address and a password |
try {
await AbrovaAuth.instance.linkGoogle(idToken: idToken, rawNonce: rawNonce);
// Same user id. currentUser.anonymous is now false.
} on AbrovaProviderAlreadyLinkedException {
// This Google account already belongs to another user.
}After linking, the user can sign in with that method on any device and reach the same account. Linking also starts a fresh session, which the SDK takes over.
When the account already exists#
If the Apple or Google account already belongs to another user of your project, linking fails with PROVIDER_ALREADY_LINKED (for a password: EMAIL_TAKEN). Nothing is merged on its own: two users' data is never combined behind your back.
What most apps do:
- Tell the user this account already exists.
- Offer to sign in to it. Call the normal sign-in (
signInWithGoogle), which replaces the anonymous session. - If the anonymous user had data worth keeping, copy it to the signed-in user in your app before you switch, or discard it.
Calling a sign-in method (not a link method) while an anonymous user is signed in switches the device to the other user. The anonymous user is not deleted, but no device holds its session any more, so it can never be reached again. Link when you want to keep the id; sign in when you want the other account.
Limits against bots#
Anonymous sign-in needs no details, so it is the easiest method to abuse. Abrova Auth limits it in three ways:
- Per device address: a burst of new anonymous users from one address is slowed down.
- Per project per day: up to 200 new anonymous users a day. You can set a lower limit under Abrova Auth › Settings › Anonymous users.
- Over a limit,
signInAnonymously()fails withRATE_LIMITED. Existing users are not affected.
Cleanup of abandoned anonymous users#
An anonymous user that never comes back is removed after a number of days without a sign-in or session renewal: 90 days by default, from 7 to 3,650 under Abrova Auth › Settings › Anonymous users. Users who linked a method are never removed this way.
Cleanup removes the user from Abrova Auth only. Documents in Sync, messages in Chat and other data stored under that user id stay where they are. Remove them in your own cleanup if you need to.