> ## Documentation Index
> Fetch the complete documentation index at: https://hercules.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in Rules

> Control who can sign up for your app. Allow everyone, or approve specific email addresses and domains before anyone can create an account.

Sign-in rules control who is allowed into your app. Keep sign-up open to everyone, or approve a list of email addresses and domains so only those people can create an account and sign in.

<div className="screenshot emerald">
  <img src="https://mintcdn.com/zeus-0f6dadbf/jq-m3a4jzLYzGf1U/images/apps/users-sign-in-rules.png?fit=max&auto=format&n=jq-m3a4jzLYzGf1U&q=85&s=dfe89281dcf7eaac32619a1180184a74" alt="Sign-in Rules tab showing sign-up access options and a table of approved domains" width="2348" height="1556" data-path="images/apps/users-sign-in-rules.png" />
</div>

### Where do I find sign-in rules?

Click **Users & Access** → **Sign-in Rules** in your app sidebar.

Sign-in rules are available on apps using Hercules Auth 2.0. If your app was created before Hercules Auth 2.0, [upgrade it first](/docs/apps/users-auth/upgrade-to-hercules-auth-2). Editing rules requires a Business plan or higher.

### Who can sign up?

Pick one of two options:

* **Allow everyone**: anyone who reaches your sign-in page can create an account. This is the default.
* **Only people I approve**: only people matching your rules can create an account or sign in.

Your choice takes effect right away. Switching back to **Allow everyone** keeps your rules saved, they just stop being enforced.

### How do I approve an email address or domain?

1. Choose **email addresses** or **domains**.
2. Paste the values into the box, one per line.
3. Add a reason if you want a note about why they are approved (optional).
4. Click **Add sign-in rule**.

Rules save as soon as you add them. Approve a domain like `acme-corp.com` to let in everyone with an email at that domain, or approve `jane@acme-corp.com` to let in one person.

### How do I remove a rule?

Click the three dots at the end of the rule's row, then click **Remove rule** and confirm.

Removing a rule can immediately change who is allowed in. Anyone who no longer matches is signed out the next time they try to sign in.

### What do blocked users see?

They see: "Your email address is not approved to access this app. Contact the app owner to request access." The message never reveals which rules exist or whether the address already has an account.

<AccordionGroup>
  <Accordion title="Are existing users affected?">
    Yes. Rules are checked when an account is created and again on every sign-in after that. Users
    who already have an account but do not match your rules are signed out at their next sign-in.
  </Accordion>

  <Accordion title="How are rules matched?">
    Matching is not case sensitive. A domain rule matches everything after the `@` in the user's
    email address, and it has to match in full. Approving `acme-corp.com` does not let in
    `jane@eng.acme-corp.com`, so add each subdomain you want to approve. If an address matches both
    a block rule and an allow rule, the block wins.
  </Accordion>

  <Accordion title="Do Phone OTP and username accounts work with an allowlist?">
    Yes, as long as you approve the right value. Those accounts have a placeholder address in place
    of a real one: a username account uses the username followed by `@username.invalid`, and a Phone
    OTP account uses an address ending in `@phone.invalid`. Approving the username or the phone
    number on its own never matches. Open **Users & Access**, copy the full address shown on the
    account, and add it as an email rule. To approve every account of that kind at once, add a
    domain rule for `username.invalid` or `phone.invalid`.
  </Accordion>

  <Accordion title="How many rules can I add?">
    Up to 1,000 rules, with each email address or domain up to 255 characters.
  </Accordion>

  <Accordion title="What happens if my plan changes?">
    Rules you already saved keep being enforced, so your app's door stays shut rather than opening
    to everyone. You can still see the list, but you need a Business plan or higher to edit it.
  </Accordion>
</AccordionGroup>

### What's next?

<Card title="Manage Users" icon="users" horizontal href="/docs/apps/users-auth/users-roles-permissions" arrow>
  Manage users, roles, and permissions
</Card>

<Card title="Customize Login & Sign up" icon="lock" horizontal href="/docs/apps/users-auth/customize-auth-portal" arrow>
  Customize login methods, branding, and domains
</Card>