Users
Users is how a product gets people of its own. The people who use your product are its end users, and the hub keeps them apart from you. Each one belongs to one product, with their own ways of signing in, their own sessions, contact details, verification codes, authenticator codes, passkeys and recovery codes. The hub treats you, the developer, the same way: you are an end user of the hub itself.
Users has two parts, Authentication and Email Signup. Invitations is its list.
Authentication
Authentication is where you decide how your product's users sign up and sign in: the sign-up mode, and which outside sign-in providers they may use.
Sign-in itself is run by the hub. The hub has a sign-in server of its own, and each product gets its own realm on it, so your users' accounts never mix with another product's. An application of yours registers with that realm, sends a user off to sign in, and gets back a token that acts as that user inside your product. That token reaches only what a user needs: who they are, the product's feature flags, its server bag, and sync.
Your product's people can sign in by email, by a verified phone number, or by their slug.
Email Signup
Email Signup is for the time before a product launches, when you want to gather the people who are interested. You keep lists of people and a library of templates. A campaign is sent to a list. You can test-send a campaign before you send it. Each list has a public key for a sign-up form you embed in your own site, and you can rotate the key.
Once a campaign has left draft, it can no longer be edited. Sends go out in the background, with the template rendered for each recipient, and a person who no longer wants the mail can unsubscribe by a link.