User access controls whether people can chat anonymously or must sign in to your app.

Open the agent's **Model & access** settings and use **Require sign-in**.

## Allow anonymous users

**Require sign-in** is off by default. Visitors can chat without an account on your site when they load a page with your installed assistant and a valid [publishable key](/publishable-keys).

You can still identify signed-in users while allowing anonymous conversations.

## Require signed-in users

Turn on **Require sign-in** to refuse anonymous conversations. Users sign in to your app, not to Teaflask.

Teaflask recognizes a signed-in user through an end-user token issued by your backend and supplied to the assistant. A logged-in page without this identity integration is still anonymous to Teaflask and cannot chat with this agent. Wire identity on every surface where you use the agent. See [Identity](/identity) for token creation and installation.

Identity determines who can chat. It does not add tools or actions to the agent or replace your API's authorization checks.

Save and [publish a revision](/revisions) to apply the access change to users.