> ## Documentation Index
> Fetch the complete documentation index at: https://hercules.app/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in Rules

> Control who can sign up for your app. Allow everyone, or approve specific email addresses and domains before anyone can create an account.

Sign-in rules control who is allowed into your app. Keep sign-up open to everyone, or approve a list of email addresses and domains so only those people can create an account and sign in.

<div className="screenshot emerald">
  <img src="https://mintcdn.com/zeus-0f6dadbf/jq-m3a4jzLYzGf1U/images/apps/users-sign-in-rules.png?fit=max&auto=format&n=jq-m3a4jzLYzGf1U&q=85&s=dfe89281dcf7eaac32619a1180184a74" alt="Sign-in Rules tab showing sign-up access options and a table of approved domains" width="2348" height="1556" data-path="images/apps/users-sign-in-rules.png" />
</div>

### Where do I find sign-in rules?

Click **Users & Access** → **Sign-in Rules** in your app sidebar.

Sign-in rules are available on apps using Hercules Auth 2.0. If your app was created before Hercules Auth 2.0, [upgrade it first](/docs/apps/users-auth/upgrade-to-hercules-auth-2). Editing rules requires a Business plan or higher.

### Who can sign up?

Pick one of two options:

* **Allow everyone**: anyone who reaches your sign-in page can create an account. This is the default.
* **Only people I approve**: only people matching your rules can create an account or sign in.

Your choice takes effect right away. Switching back to **Allow everyone** keeps your rules saved, they just stop being enforced.

### How do I approve an email address or domain?

1. Choose **email addresses** or **domains**.
2. Paste the values into the box, one per line.
3. Add a reason if you want a note about why they are approved (optional).
4. Click **Add sign-in rule**.

Rules save as soon as you add them. Approve a domain like `acme-corp.com` to let in everyone with an email at that domain, or approve `jane@acme-corp.com` to let in one person.

### How do I remove a rule?

Click the three dots at the end of the rule's row, then click **Remove rule** and confirm.

Removing a rule can immediately change who is allowed in. Anyone who no longer matches is signed out the next time they try to sign in.

### What do blocked users see?

They see: "This app is limited to approved email addresses. Contact the app owner to request access." The message never reveals which rules exist or whether the address already has an account.

<AccordionGroup>
  <Accordion title="Are existing users affected?">
    Yes. Rules are checked when an account is created and again on every sign-in after that. Users
    who already have an account but do not match your rules are signed out at their next sign-in.
  </Accordion>

  <Accordion title="How are rules matched?">
    Matching is not case sensitive. A domain rule matches everything after the `@` in the user's
    email address, and it has to match in full. Approving `acme-corp.com` does not let in
    `jane@eng.acme-corp.com`, so add each subdomain you want to approve. If an address matches both
    a block rule and an allow rule, the block wins.
  </Accordion>

  <Accordion title="Do Phone OTP and username accounts work with an allowlist?">
    No. Those accounts have no real email address to match, so they cannot sign in while **Only
    people I approve** is on. Use an email based sign-in method instead, or keep sign-up open to
    everyone.
  </Accordion>

  <Accordion title="How many rules can I add?">
    Up to 1,000 rules, with each email address or domain up to 255 characters.
  </Accordion>

  <Accordion title="What happens if my plan changes?">
    Rules you already saved keep being enforced, so your app's door stays shut rather than opening
    to everyone. You can still see the list, but you need a Business plan or higher to edit it.
  </Accordion>
</AccordionGroup>

### What's next?

<Card title="Manage Users" icon="users" horizontal href="/docs/apps/users-auth/users-roles-permissions" arrow>
  Manage users, roles, and permissions
</Card>

<Card title="Customize Login & Sign up" icon="lock" horizontal href="/docs/apps/users-auth/customize-auth-portal" arrow>
  Customize login methods, branding, and domains
</Card>