An auth guard around everything
Lovable, Bolt and v0 scaffolds often wrap the whole router in a protected route, so the first screen of the app is a login form.
What 5.1.1(v) says
The account sign-in part of Guideline 5.1.1 says that an app without significant account-based features should let people use it without logging in. Apps may not require personal information to function unless it is directly relevant to the core functionality or required by law. Apps that support account creation must offer account deletion in the app. And if the core function is not tied to a specific social network, people must be able to use the app without logging in to one; pulling profile data, sharing and inviting friends do not count as core functions.
The other parts of 5.1.1 (privacy policy, purpose strings, data minimization) are covered in the 5.1.1 privacy guide. This page is about the login wall.
What the rejection message usually says
The note usually says that the app requires users to register or log in before they can access features that are not account based, and suggests letting users use those features freely while requiring registration only for account-specific ones. A frequent variant says the app requires personal information, such as a phone number, birthday or gender, that its core function does not need. Another variant concerns purchases: the app forces registration before buying In-App Purchases that are not account based.
Which features may sit behind a login
| Feature | Account-based? | Behind a login? |
|---|---|---|
| Browsing a catalog, reading articles, viewing recipes | No | No, make it public |
| Calculators, converters, generators, a limited free AI demo | No | No, or a guest session |
| Favorites, history, sync across devices | Yes | Yes; ask when the user saves something |
| Posting, chatting, following other users | Yes | Yes |
| Orders, bookings, invoices, team workspaces | Yes | Yes |
| An app for existing members, employees or customers of a service | Yes, the account is the core | Yes; explain it in the review notes and provide a demo account |
| A subscription that also works on the web | Yes, cross-platform | Yes; say so in the review notes |
My iOS WebView is finally approved. Thanks!!
Why AI-built apps hit the login wall
Start URL on /login or /dashboard
The marketing page is the public part of your website, so many people set webviewurl to the app area, which redirects straight to login.
Sign-up forms that ask too much
Phone, birthday, gender and company fields generated "just in case" are personal information the core function does not need.
Social-only login
Only "Continue with Google" means nobody gets in without a social account. Add email login or Sign in with Apple, and consider a guest path.
Add a guest path without rebuilding your app
Mark every feature as public or account-only
Go through every screen. Usually, discovery and reading are public; saving, posting, account-tied purchases and personal data are account-only.
Point the app at a public start page
Set
webviewurlin Config.swift to a page that works without login, such asyourdomain.com/appor/explore, not/login. Changing it needs a new build.Move the auth guard to the account routes
Public routes render for everyone; only account routes redirect to login (code below). Put "Sign in" in the header or on the first save, not in front of the content.
Use anonymous sessions where guests need state
If guests should be able to save progress, use Supabase anonymous sign-ins, Firebase anonymous auth or local storage, and convert the guest to a full account at sign-up so nothing is lost. Protect anonymous sign-ups with a captcha and row-level security; the Supabase checklist lists the settings.
Trim the sign-up form
Email and password (or Sign in with Apple), plus a name if you really need it. Ask for anything else later, when a feature needs it, and mark optional fields as optional.
Keep deletion and the demo account
Account creation still requires deletion inside the app (account deletion guide), and account features still need a demo account for review (demo account guide). Keep
deletecachefalse so signed-in users stay signed in.
Public routes first, login only where it matters
React Router example, as generated by most AI builders, plus a Supabase guest session for saving.
javascript
// Before (typical AI scaffold): every route behind <RequireAuth />
// <Route element={<RequireAuth />}> ...all routes... </Route>
// After: public discovery, account features behind the guard
<Routes>
<Route path="/" element={<Explore />} /> {/* no account needed */}
<Route path="/recipes/:id" element={<Recipe />} /> {/* no account needed */}
<Route path="/login" element={<Login />} />
<Route element={<RequireAuth />}>
<Route path="/favorites" element={<Favorites />} /> {/* account-based */}
<Route path="/settings/account" element={<Account />} />
</Route>
</Routes>
// A guest taps "Save": start an anonymous session, upgrade it later
async function saveAsGuest(recipeId) {
const { data } = await supabase.auth.getSession();
if (!data.session) await supabase.auth.signInAnonymously();
await supabase.from("favorites").insert({ recipe_id: recipeId }); // user_id defaults to auth.uid()
showBanner("Saved. Create a free account to keep your favorites on all devices.");
}
// Upgrade later: supabase.auth.updateUser({ email }) turns the anonymous user into a permanent onePrompt: open the app for guests
Let the AI do the restructuring, but review its list of public and account-only routes before it changes code.
Prompt for Lovable, Bolt, v0, Cursor or Claude Code
Restructure authentication for App Store Guideline 5.1.1(v). 1) List every route and classify it as public (works without an account) or account-only (saving, posting, purchases tied to the account, personal data). Show me the list before you change code. 2) Remove the global auth guard and apply it only to account-only routes. 3) Make / a public start page that shows the core content without login. 4) When a guest tries an account-only action, show a friendly sheet: "Create a free account to save this", with Sign in with Apple, email sign-up and a "Not now" option. 5) Use Supabase anonymous sign-in for guests who need to save state, and convert them to a permanent account at sign-up without losing data. Keep row-level security on all tables. 6) Reduce the sign-up form to email, password and an optional name. Remove phone, birthday and gender unless a feature needs them. 7) Keep the existing Delete account flow in settings.
Resolution Center reply template
Option A if you opened the app; option B if login is genuinely essential. Be specific either way.
Reply in Resolution Center (choose option A or B)
Hello App Review team, Thank you for reviewing [App name] [version] ([build]). [Option A: guest access added] Users can now [browse / read / use the calculator] without an account. The app opens on [Explore], and an account is requested only when a user wants to [save favorites / post / sync across devices], which are account-based features. Sign-up now asks only for email and password, or Sign in with Apple. [New build: [number].] [Option B: login is essential] [App name] is a [client portal / team workspace] for [existing customers of X / members of Y]. Every feature works on the user's own account data: [list the main features]. There is no content that could be shown without an account. Accounts are created [at sign-up in the app / by the customer's organization]. A demo account is provided in App Review Information. Account deletion is available in [Settings > Account > Delete account]. Best regards, [Name], [email]
Checklist
- A new user reaches every non-account feature without registering.
webviewurlpoints to a public page, not to the login screen.- The login prompt appears at the first account action, with a way to decline.
- The sign-up form asks only for what the account needs.
- Social login is not the only way in.
- In-app account deletion and a working demo account are in place.
Frequently asked questions
My app is a dashboard for paying customers. Do I need a guest mode?
Not if every feature works on the customer's own account data. Explain that in the review notes and provide a demo account. A public page that shows what the app does for people who are not customers yet is a nice extra.
Does "Continue as guest" have to be on the first screen?
There is no fixed placement. What matters is that a new user reaches the non-account features without registering. A public start page with a "Sign in" button in the header is usually the cleanest solution.
Can I require an account before an In-App Purchase?
When the purchase is tied to the account, for example a subscription that also unlocks the web version, yes; say so in the review notes. For purchases that only work on the device, reviewers expect registration to be optional.
Is Google-only login a 5.1.1(v) problem?
It can be: if your core function has nothing to do with Google, people must be able to use the app without a Google login. Guest access or email login solves that, and Guideline 4.8 additionally asks for Sign in with Apple or a similar option next to Google.
Do guest users need account deletion?
The deletion requirement applies to accounts users create. For anonymous sessions, a "Clear my data" option in settings is good practice, and once a guest converts to a full account, the normal Delete account flow applies.
Three ways to get your app into the stores
Same result, different amount of work on your side. All three come with the approval guarantee and 24/7 human support.
Do it yourself
$109 per platform, one-time
The WebViewGold license: a finished Xcode or Android Studio project. Paste your URL, set name and icon, switch on features, build and submit. Free updates forever.
See plans on the main pageCloud Builder
$349 per license, one-time add-on
No Mac, no Xcode, no Android Studio: configure in the browser, we build both apps in the cloud and hand them to App Store Connect and the Play Console.
How the Cloud Builder works Try the free demoFull Service
$698 per platform $798
Send us your URL and icon. Our team configures, builds and delivers your app within 72 hours, white-label, with source projects. Both platforms for $1,158.
Full Service details Powered by
Winter Sale prices valid until December 31, 2026.