---
title: "Check every sign-in and permission flow · Agent Wranglers"
url: https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/check-auth-flows
updated: 2026-10-20
licence: "All rights reserved"
---

# Check every sign-in and permission flow

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Apps built with AI builders](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders)
- Rule: Test sign-up, sign-in, password reset and every admin page as a stranger and as a normal user before launch.
- How: Builders produce sign-in screens that look right but leave pages and API routes open. Hiding a link is not a check. Follow the [access and accounts chapter](https://agentwranglers.se/playbook/adversarial-testing/access-and-accounts).
- Check: Signed out, open every page and call every API route found in the code. Only public ones answer. As a normal user, admin routes answer 403 or 404.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers ai development playbook: https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/check-auth-flows`.

- Previous: [Keep secret keys on the server](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/server-side-keys)
- Next: [Own the code in your own repository](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders/own-the-code)
- [Apps built with AI builders](https://agentwranglers.se/playbook/ai-assisted-development/apps-built-with-ai-builders)