> For the complete documentation index, see [llms.txt](https://codemash.gitbook.io/codemash/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://codemash.gitbook.io/codemash/cloud/membership.md).

# Membership

Users, sign-in and access control for your app — roles, policies, triggers and sign-in providers.

**Membership** is the identity layer of your app: the users of your project and how they sign up and sign in (password, username, phone, passkey), the roles and policies that decide what each user may do, triggers that act on user events, and outside sign-in providers. Your app calls it through the SDK, the CLI or the API; Cloud is where you set it up and look after your users.

## Enable the module

Open **Membership** in the left bar. When the module is off, the start page **Norbix Membership** shows what it does; press **ENABLE**. A project created with a database starts with Membership on.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-43623cf0412222919890e66bbeb6ccddaae679be%2Fenable-1.png?alt=media" alt="Norbix Membership start page: Manage users in one place, Sign in with the providers your users already use, Roles and policies that scale, and the ENABLE button"><figcaption><p>Membership → start page.</p></figcaption></figure>

After **ENABLE**, Cloud opens **Users**, empty.

<figure><img src="https://712692422-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FHy372bqsaex2cqS3ikhL%2Fuploads%2Fgit-blob-795e2a5d4f8ca2ed3e26a03b70ec3de908b5aa18%2Fenable-2.png?alt=media" alt="Users list right after enabling: no rows, the Add New button"><figcaption><p>Membership is on.</p></figcaption></figure>

## Module map

| Screen                                                     | What it is for                                                                                        |
| ---------------------------------------------------------- | ----------------------------------------------------------------------------------------------------- |
| [Users](/codemash/cloud/membership/users.md)               | The people of your project, their profile, roles, marketing preferences and logins.                   |
| [Roles](/codemash/cloud/membership/roles.md)               | Bundles of policies you give to users.                                                                |
| [Policies](/codemash/cloud/membership/policies.md)         | Permission statements, written as JSON documents.                                                     |
| [Triggers](/codemash/cloud/membership/triggers.md)         | Actions that run when a user registers, is updated, deleted, blocked…                                 |
| [Integrations](/codemash/cloud/membership/integrations.md) | Sign-in providers: Google, Apple, Microsoft, GitHub, Meta, X, Okta.                                   |
| [Settings](/codemash/cloud/membership/settings.md)         | Registration, passwords, emails, passkeys, account closing, communication topics, disable the module. |

## Your first user with a role

1. [Create a policy](/codemash/cloud/membership/policies/new.md) — for example `orders-read`, read access to one collection.
2. [Create a role](/codemash/cloud/membership/roles/new.md) — `content-editor` with that policy.
3. [Add a user](/codemash/cloud/membership/users/new.md) — with email and password, and the role.
4. [Create a trigger](/codemash/cloud/membership/triggers/new.md) — email your team on every new sign-up.

## Use it from code

Every **Do it from code** block in the Membership pages uses this client. Install `@norbix.ai/ts` (see [SDK install](/codemash/sdks/install.md)) and set `NORBIX_API_KEY` — see [Keys and environments](/codemash/get-started/keys-and-environments.md).

```ts
import { Norbix } from '@norbix.ai/ts';

const projectId = 'pr_5ArJCRo2mJ90H2Fp1oU6ta';
const norbix = new Norbix({ projectId }); // the key comes from NORBIX_API_KEY

const { roles } = await norbix.hub.membership.getRoles();
console.log(roles.map((r) => `${r.displayName ?? r.name} (${r.isSystem ? 'System' : 'Custom'})`));
```

The CLI lines use the generic `norbix hub …` and `norbix api …` commands of `@norbix.ai/cli` (signed in with `norbix login`, project id in `NORBIX_PROJECT_ID`):

```sh
norbix hub membership roles get
```

{% hint style="info" %}
The client sends the project id with every call (the `norbix-project-id` header), so the requests do not repeat it. The CLI does the same with the project of `norbix login --project …`, `norbix config set projectId …` or `NORBIX_PROJECT_ID`. The examples were run with a signed-in session against a test stack (`@norbix.ai/ts` 4.13.0, `@norbix.ai/cli` 1.16.0; last on 2026-10-07).
{% endhint %}

## Related

[Permissions](/codemash/cloud/concepts/permissions.md) · [Triggers](/codemash/cloud/concepts/triggers.md) · [Integrations](/codemash/cloud/concepts/integrations.md) · [SDK](/codemash/sdks/membership.md) · [CLI](/codemash/cli/cli.md) · [API](/codemash/api-reference/membership.md) · [Admin portal sign-in](/codemash/admin/admin.md)