How to manage users in Bubble

Managing users in Bubble mainly means using the built‑in User data type, handling sign up/log in workflows, setting correct Privacy Rules, and creating workflows that update user fields safely (often using Make changes to current user or backend workflows for admin actions). The key is letting Bubble handle authentication while you control what each user can see or do through privacy rules and workflows.

Core Concepts

The User data type already exists in every Bubble app. It stores things like email, password (encrypted), and any custom fields you add. You do not create another “users” table. You just add fields to this built‑in type, for example: role, onboarding_completed (yes/no), or subscription_status.

• Sign up / Log in: These are Bubble’s built‑in authentication actions. They automatically create and authenticate the User.
• Current User: Bubble always knows who is logged in; this lets you display user‑specific data without extra logic.
• Privacy Rules: These decide what each user can see or modify in the database. This is crucial for security.
• Backend workflows: Use these for actions that modify other users (admins, scheduled tasks, or systems like Stripe webhooks).

How to Manage Users Step by Step

Create user fields: Go to Data → Data types → User → Add fields like "role" (text) or "profile\_photo" (image). These fields become accessible everywhere.

Sign Up Workflow: Add an action “Sign the user up”. Bubble stores email + password, then logs them in instantly. After that, you can run “Make changes to current user” to set fields.

Make changes to current user
role = "customer"
onboarding_completed = no

Log In Workflow: Use “Log the user in”. Bubble handles authentication automatically.

Privacy Rules: In Data → Privacy, set rules like “When This User is Current User → They can read/write their own fields”. This prevents users from accessing others’ data.

Admin Actions: If an admin needs to modify another user (example: change role), trigger a backend workflow using “Schedule API workflow” so the change happens securely on the server.

Backend workflow: Make changes to a thing
Thing to change = User (sent as parameter)
role = "admin"

Logging Out: Use “Log the user out” when needed.

Best Practices

• Never expose the full list of Users on a page; use privacy rules.
• Do not store passwords manually; Bubble handles encryption.
• For anything sensitive (like changing someone else’s fields), use backend workflows.
• Use the “Only when Current User is logged in” conditions to protect UI elements.