When to use it

Some apps are a companion to a website: people create their account (and pay, if the
service is paid) on the website, then sign in to the app with that account. The app
must not create accounts of its own.

Hiding the Sign Up button in the app settings is not enough on its own. Older app builds,
and anyone calling the server directly, can still ask the server to create an account.
The Login only setting makes the server refuse.

What Login only does

When it is on:

• App sign up is refused. An app request to create an account with an email and
  password gets a failed response with a neutral message. No user is created.
• Sign in with Apple and Google never create an account. When the Apple ID or Google
  account matches an existing user, that user signs in exactly as before. When it matches
  nobody, the server refuses instead of creating a new user.
• The legacy login endpoint (older app builds) refuses its sign up and Google account
  creation requests the same way.
• Existing users are not affected. Email and password login, Face ID / Touch ID login,
  Forgot Password, and invited users setting their password all work as before.

When it is off (the default), nothing changes.

Steps

1. In wp-admin, open Mobile App Mgr → App Navigation → User Roles.
2. Under Account Management, set Login only to Yes. It saves as soon as you pick it.
3. Turn off the app’s sign up settings on the Login button (Allow user to sign up with
   Email) so the app does not show a Sign Up option that the server will refuse. Think
   before turning off Allow user to sign up with Apple and Google: on iOS that setting
   also hides Sign in with Apple and Google for existing users who log in that way.
4. Make sure people have a way to create an account on your website, and tell them where
   it is (for example in your app store description or on your website).

The message people see

A refused sign up shows this message by default:

New accounts cannot be created in the app. Please log in with your existing account.

Change it with the mam_login_only_message filter. The second argument says which request
was refused: signup, oauth_apple, oauth_google or legacy_signup.

add_filter( 'mam_login_only_message', function ( $message, $context ) {
    return 'Use the email and password for your Example account.';
}, 10, 2 );

Turning it on from a plugin

A site plugin can decide instead of the setting:

The option itself is mam_login_only ('yes' or 'no'). When a plugin overrides it, the
settings screen says so under the dropdown.

Rewording the “no account” messages

Some fixed server messages tell people to sign up. On a login-only app you may want
different wording. Two filters cover them, and they work whether or not Login only is on.

add_filter( 'mam_login_no_account_message', function ( $message, $context ) {
    return 'Use the email and password for your Example account.';
}, 10, 2 );

Checking it

• With Login only on, a sign up attempt from the app shows the message above and no new
  user appears in wp-admin.
• An existing user can still log in with email and password, and with Apple or Google if
  they signed in that way before.

Metadata