AuthBox is how your members get into your course — a one-time code emailed to them, checked against a real purchase in your store, on every single sign-in. No passwords, no spreadsheets of access, nothing for you to police.
We sent a 6-digit code to alex@example.com
Every membership site needs the same three things: a way to sign members in, a way to know who actually paid, and a way to keep non-payers out of the content. AuthBox is all three — built into the Course in a Box templates from day one, with nothing to code and one Project ID to paste.
Members enter their email and get a one-time code, branded with your course name. No passwords to create, forget, reset — or leak. They never hear the word “AuthBox.”
AuthBox is wired to your Lemon Squeezy store. Buy = in. Refund or cancel = out, automatically. You never manually grant or revoke anyone.
Your videos, downloads, and forms verify each member on the server, on every request. Hiding a page in Framer isn’t security — this is.
This whole loop runs in seconds, on your domain, without you touching anything.
On the sign-in page of your site — your domain, your branding, designed into the template.
It looks up that email against your Lemon Squeezy store for a paid, qualifying purchase. No purchase, no code — full stop.
Six digits, branded with your course name. It expires in 10 minutes, allows five attempts, and is stored only as a cryptographic hash.
The member gets a signed session, and every gated video, file, and form re-verifies it server-side. A refunded member is out on their next click.
These aren’t marketing bullets — each one is how AuthBox actually behaves, and the whole flow is covered by an automated test suite that runs before every release.
There are no member passwords to steal, because none exist. One-time codes are stored hashed with a server secret, compared in constant time, capped at five attempts, and dead in ten minutes.
Nobody gets in unless their purchase matches a product you explicitly selected. An unconfigured project grants no one — the safe answer is always “no” until you say otherwise.
A refund or cancellation in your store cuts access instantly via signed webhook — and AuthBox periodically re-checks active members against your store as a backstop, so even a missed event self-heals.
Every video stream, download, and upload is verified server-side, per request. Identity comes from the verified session — never from an email the browser claims. Video links are signed and expire in hours, so sharing them is pointless.
Sign-in tokens are minted for your project and only yours. A valid session from any other AuthBox-powered site is rejected at your door — courses can never unlock each other.
Purchase events from your store are cryptographically signature-verified, then fingerprinted so a captured event can’t be replayed later to resurrect revoked access.
Every public endpoint is rate-limited per IP — a fast burst window and a slow sustained window — running on Cloudflare’s edge network, the same infrastructure that absorbs the internet’s largest attacks.
If the payment API blips, AuthBox never wrongfully locks out a paying member — and an error never grants access to someone without a purchase. Uncertainty always resolves to the safe side.
The $15/month covers the auth infrastructure — and it includes direct, personal technical support. Not a chatbot, not a ticket queue three timezones deep: you reach out, a person who built this answers.
AuthBox ships with a portable, self-hostable version — the same service, deployable into your own free Cloudflare account, running for $0/month, forever, with no dependency on us at all.
Most owners never use it, and that’s the point. It exists so the worst-case question — “what if this company disappears?” — has a concrete answer: your members never lose access. Your stack stays yours either way.
A clean sign-in page on your domain, styled by your template, sending codes branded with your course name. AuthBox is invisible to them — as far as your members know, you built this.
No and no. Payments go directly from your customers to your Lemon Squeezy account. AuthBox asks your store exactly one kind of question — “does this email have a qualifying purchase?” — and acts on the answer.
Sign-in depends on AuthBox being reachable — that’s true of every auth service, including the big ones. AuthBox runs on Cloudflare’s global edge network, the same platform that hosts your videos and files. And unlike other providers, if the answer ever stops satisfying you, the self-host version removes us from the equation entirely.
You could — and you’d wire it to your payments, your templates, and your content gating yourself, then pay monthly anyway. AuthBox exists because Course in a Box needed auth that’s already integrated with all of it: the templates, the purchase checks, the video and file gating. One Project ID, pasted once.
AuthBox is included with Course in a Box — alongside the Framer templates, gated video and file hosting, email marketing, and setup videos for every step. $399 once, then $15/mo for AuthBox with human support — or self-host it for $0.
Get Course in a Box $399Secure checkout via Lemon Squeezy · instant access