Control how new users enter hosted sign-up

Hosted sign-up used to be mostly on or off. Teams that wanted invite-only or waitlist behavior needed extra checks that did not always apply to OAuth sign-up. Environments now evaluate an explicit sign-up mode and apply it to hosted and OAuth registration.

This is the longer note behind the December 16 changelog entry.

How it works

environments_restrictions.signup_mode stores one of:

• public (default) — self-service registration follows enableRegistration
• restricted — registration is limited to invited users; hosted copy says registration is restricted
• waitlist — the hosted flow treats the session as waitlist

resolveSignupModeState normalizes the stored value and combines it with enableRegistration:

• restricted always sets registrationDisabled
• otherwise registration is disabled when enableRegistration is false

The same helper runs on hosted sign-up and on OAuth sign-up handling, so a social first-login cannot bypass a restricted environment. Email/password and waitlist signup handlers also read signup_mode.

Automated tests cover the supported modes.

Email allowlists, blocklists, and disposable-address flags on the same restrictions row are separate from mode. Mode decides whether new users may enter; those flags decide which addresses are acceptable when they can.

Set it up

In the console, open environment restrictions / registration settings:

1. Choose public, restricted, or waitlist.
2. Keep enableRegistration consistent with that choice.
3. Exercise hosted sign-up and an OAuth sign-up path.

Restricted mode is not a substitute for turning off unused social connections.

Trust boundaries

Mode evaluation is server-side. A crafted /signup URL does not override restricted. Waitlist admission is not an authenticated session.

public plus enableRegistration false still blocks self-service sign-up.

Try it

Set restricted, try hosted sign-up, then an OAuth first-login, and confirm both are blocked without an invite. The original release note is in the changelog.