Modules Reference

Email/password auth with JWT — register, login, refresh, logout, email verification, password reset/change, OAuth account linking (Google/GitHub/Microsoft, PRO tier), and session management.

Stripe + Razorpay integration — subscriptions, checkout sessions, the customer portal, refunds, and invoice history. See Billing Setup for the real webhook event list.

Role-based access control. No dedicated schema or standalone module of its own — a guards/decorators library the other modules apply to their own routes; roles live on the User record directly. See Authentication & RBAC.

Programmatic API access with hashed key storage. The generated key is shown exactly once and is never retrievable again after creation.

Guided checklist widget that drives user activation on first login.

Publish release notes and feature announcements to users, with per-user read tracking.

Team management with its own RBAC layer — create/update/delete teams, invite and remove members, change member roles.

In-app + email notifications, with per-user preferences.

Track metrics, user growth, and revenue.

Admin-controlled feature toggles per user, team, or plan.

User-managed outbound webhook endpoints with signed deliveries, a retry queue, and delivery history — for your own customers to consume.

Built-in help desk with threaded messages per ticket.

Drag-and-drop automation — define triggers/actions/conditions, execute on demand, inspect execution history.

Complete, tamper-evident audit trail — list, filter by resource, verify a single entry’s integrity hash, bulk-verify a filtered set, export to CSV, and view aggregate statistics.

Breach-notification tracking — log incidents, mark affected users, and notify them.

Custom branding, logos, colors, and a verified custom domain per tenant.

TOTP, SMS, hashed backup codes, WebAuthn/passkeys, and SSO/SAML. See Authentication & RBAC for the real security specifics (challenge windows, replay protection, session expiry).