Xano (Authentication System)

Xano can be used as an Authentication System in WeWeb when you want to sign users in with your own Xano endpoints and keep the session inside WeWeb.

What this system supports

• Sign in and sign up flows powered by your own Xano endpoints
• Session storage in WeWeb using the token returned by Xano
• Loading the current user on refresh with On user load
• Workflow templates for Sign In, Sign Up, Log Out, and Fetch Current User

Set up Xano

1) Prepare your Xano project

Before connecting Xano in WeWeb, make sure your Xano project already has the endpoints you want to use for authentication.

Most projects will need:

• A sign-in endpoint such as /auth/login
• A sign-up endpoint such as /auth/signup
• A current-user endpoint such as /auth/me

Your sign-in and sign-up endpoints should return a token that WeWeb can store in the session. The built-in Xano templates are already set up to read either authToken or accessToken. If you also return refreshToken or metadata, you can store those too.

You will also need a Xano Meta API Key so WeWeb can list your instances, workspaces, and API groups when you set up the connection.

2) Connect Xano in WeWeb

1. Open the Data & API tab, then open the Authentication subtab.
2. • A) If this is your first time opening the Authentication area, choose Xano when prompted.
   • B) If this is not your first time, open the Settings tab, expand Switch Authentication Provider, and click Switch Authentication, then select Xano.
3. Create or select a Xano connection for the current environment.
4. Fill in the connection fields:
   • Meta API Key
   • Instance
   • Workspace
5. Optional fields you can also set:
   • Custom Domain
   • Branching, With X-Branch and X-Data-Source
   • Global Headers

If you use different Xano setups for the editor and production, save the values for each environment inside the same connection.

Learn more about the Xano connection settings →

Build the auth flows

Once Xano is your current Authentication System, WeWeb shows Xano auth workflow templates that you can start from.

Sign in template

On a sign-in form, use the Xano template Sign In.

This template:

1. Calls your Xano sign-in endpoint
2. Stores the returned session with Authenticate Xano
3. Navigates to the page you choose

By default, the template points to POST /auth/login, but you can change the endpoint path and API group if your Xano project uses a different route.

Sign up template

On a sign-up form, use the Xano template Sign Up.

This template:

1. Calls your Xano sign-up endpoint
2. Stores the returned session with Authenticate Xano
3. Navigates to the page you choose

By default, the template points to POST /auth/signup, but you can change it if needed.

Log out template

On a button or similar element, use the Xano template Log Out.

This template clears the current Xano session in WeWeb, then navigates to the page you choose.

Fetch Current User template

For app-level auth loading, use the Xano template Fetch Current User on the trigger On user load.

This template:

1. Calls your Xano current-user endpoint. WeWeb sends the session token already stored in WeWeb with the request, so you don't need to add an Authorization header.
2. Finishes with Set user, using the body of the response.

By default, the template points to GET /auth/me. Select your API group, and change the path if your project uses a different endpoint.

On user load runs after Authenticate stores a session, and when the app opens with a session saved in the browser.

Load the user in backend workflows

If you also use WeWeb backend workflows, API Endpoints, or tables fetched by the WeWeb server, they need to know who the user is too. Create a backend workflow on the On user load trigger, with the same two steps: retrieve the user from Xano, then finish with Set User.

Without it, your backend treats every request as signed out, and any Security setting that requires a signed-in user rejects the request.

Learn more about using Xano with WeWeb backend workflows →

Sign in with a social provider

Your Xano workspace can have OAuth endpoints for a provider such as Google, installed from the Xano marketplace. Their paths look like /oauth/google/init and /oauth/google/continue. You build the flow with API Request actions in Interface workflows:

1. Call the init endpoint with a redirect_uri: the full address of a callback page in your app. Xano returns an authUrl.
2. Send the user to that authUrl with a Navigate to action, as an external link.
3. The provider sends the user back to your callback page with a code in the address. In a workflow on that page's load, call the continue endpoint with this code and the exact same redirect_uri.
4. Finish with Authenticate, using the token returned by the continue endpoint.

Add the address of your callback page to the authorized redirect addresses in your provider's settings (for example the Google Cloud Console), or the provider stops the flow before the user can sign in. Each code can only be used once: if the continue call fails, start again from init.

Xano auth actions in workflows

When Xano is the current Authentication System, WeWeb gives you Xano auth actions such as:

• Authenticate
• Set User
• Clear Session

Authenticate and Clear Session are available in Interface workflows. Set User is also available in backend workflows.

See every input of these actions →

Authenticate

Use Authenticate after your Xano sign-in or sign-up request succeeds.

It can store:

• Auth Token
• Refresh Token
• Metadata
• Persist Session

The Xano templates already map authToken and accessToken for you, but you can update the mapping if your response uses different key names.

Set User

Use Set User after you fetch the current user from Xano.

This is what makes the authenticated user available in WeWeb for page protection, access checks, and display in the interface.

Clear Session

Use Clear Session when you want to log the user out inside WeWeb.

Test sign in

1. Build a simple sign-in form in the Interface.
2. Create a workflow on the form and use the Xano → Sign In workflow template .
3. Configure the Xano request to use the correct API group and endpoint.
4. Map the body fields your Xano endpoint expects, such as email and password.
5. Preview the app and sign in with a test user.
6. Confirm that:
   • The session is stored
   • The user is redirected correctly

For page and API protection, see Users and roles →.

Common pitfalls

The user signs in, but looks signed out after refresh

This usually means On user load is not set up yet, or the workflow does not finish with Set user.

The sign-in request succeeds, but WeWeb does not store the session

Check the token mapping in Authenticate. The default template expects authToken or accessToken.

If your Xano response uses a different key name, update the binding in the action.

Reference

Connection fields

Field	Description
Meta API Key	Key used by WeWeb to list your Xano instances, workspaces, and API groups
Instance	The Xano instance you want to connect
Workspace	The Xano workspace you want to use
Custom Domain	Optional custom domain for your Xano project
Branching	Turns the X-Branch and X-Data-Source fields on or off
X-Branch	Optional Xano branch used by your requests
X-Data-Source	Optional Xano data source used by your requests
Global Headers	Optional headers sent on all Xano requests

CONTINUE LEARNING

Next, build the actual Xano sign-in flow with the ready-made templates and show the signed-in user's data in your app.

Sign users in and get their info with Xano →