Nextcloud self-registration: e-mail confirmation, admin approval and custom fields

If you run a Nextcloud for a team, a club or a community, the moment always comes when someone asks: "Can I just create an account myself?" Nextcloud ships with accounts that administrators create, and the Registration app covers the bare minimum. What it usually lacks is the boring-but-important part: proving the address is real, keeping a queue of new accounts for review, asking for the data you actually need, and keeping spam out without leaking who is already registered.

That is what Sign-up does. It adds a self-registration page to your Nextcloud, linked from the sign-in screen as Create an account. Visitors enter their e-mail address, the data you ask for and a password, accept your terms, and get an account — after confirming the address, after you approve it, or right away. You decide. This tutorial walks through the settings in the order I would configure them on a fresh instance. The full reference lives in the user guide.

Prerequisites

• Nextcloud 30 to 34 and PHP 8.1 or newer.
• Background jobs configured, Cron recommended.
• A working e-mail configuration. Sign-up sends confirmation codes, decisions and welcome e-mails through Nextcloud's mailer, so test it first under Administration settings → Basic settings → Email server with the "Send email" test.
• A Sign-up license: monthly, yearly or lifetime per instance, included in the Nextcloud bundle, or a 30-day free trial. Without a valid license the registration page shows "temporarily unavailable" and the link on the sign-in page is hidden — existing accounts are untouched.
• Only if you want paid plans: Cashier 1.2 or newer with a connected Stripe account.

Step 1: Install and license the app

1. Sign in to your MediaLab Works account, open Licenses and download signup-x.y.z.tar.gz.
2. Extract it into apps/ (or custom_apps/) so that you get apps/signup/, owned by the web-server user.
3. Enable it from the Apps page or with:

sudo -u www-data php occ app:enable signup

4. Go to Administration settings → Sign-up → License, paste your key (or start the trial) and save. The section should show Active.
5. Open https://<your-cloud>/index.php/apps/signup/ to see the page, and check that the sign-in screen now shows Create an account.

Step 2: Decide what visitors can do

Under Registration you open or close registration and choose what is offered: free accounts and paid plans, free accounts only, or paid plans only. Paid plans only appear when Cashier actually offers them. You can also set the text of the sign-in page link in English and Romanian.

My advice: start with free accounts only until you are happy with the form and the confirmation flow, then add plans later.

Step 3: E-mail confirmation

Keep E-mail confirmation on — it is the cheapest spam filter you will ever deploy. No account exists before the address is confirmed, and unconfirmed registrations expire on their own (24 hours by default; you can set 1 to 168 hours).

You choose code and link, code only or link only. The six-digit code is typed on the page; the link can be opened on any device and the page continues by itself. If you turn confirmation off, the account is created as soon as the form is sent, and the page has to state when an address already has an account — which is exactly the privacy trade-off described below.

Step 4: The approval queue

Turn on Administrator approval if you want to look at every free account before it goes live. After the e-mail confirmation, the account is created disabled and waits under Registrations → Waiting for approval. Administrators get a Nextcloud notification and, optionally, an e-mail.

• Approve enables the account, adds it to the groups and e-mails the user.
• Reject deletes the never-used account and the registration data and e-mails the user — with your reason, if you give one.

Paid accounts never wait: the payment activates them. The Registrations list also has Waiting for confirmation or payment (no account yet; you can remove one), Recent accounts for the last 30 days and the rejected ones.

Step 5: Build your form

The e-mail address, the password and the acceptance of the terms are always asked. For first name, last name, phone, company, street address, city, postal code and country you pick Not asked, Optional or Required.

Then add your own fields: text, long text, phone, date, list or tick box, with labels in English and Romanian, options for list fields, and arrows to order them. Phone, company and address also go to the user's profile (private); everything is shown to administrators next to the registration and to the user under Personal info → Registration details. Ask only for what you will actually use.

Step 6: Defaults for new accounts

Under New accounts set the login name (the e-mail address, ana.popescu from the name, or chosen by the visitor — everyone can sign in with the e-mail address anyway), the storage quota (empty means the cloud's default) and the groups. Write a welcome e-mail with your own text. The password follows your Nextcloud password policy.

Step 7: Anti-abuse

Under E-mail addresses and abuse protection you can restrict registration to certain domains (empty means all; *.example.org covers subdomains), block domains, and block temporary addresses — a built-in list plus a list MediaLab Works keeps up to date, delivered with a valid license. You can also set a minimum time to fill in the form and a daily limit per network address.

Always on, without configuration: Nextcloud's rate limits and brute-force protection, a hidden field only bots fill in, 5 confirmation e-mails per address per day and 5 attempts per code. If you already run a captcha app, it can plug into the form.

Step 8: Privacy and terms

The detail I appreciate most: if an address already has an account, it gets an e-mail instead of a code, so the page never reveals who is registered. The password is kept only encrypted until the account exists. Under Terms and privacy set the addresses of your terms of use and privacy policy; the visitor ticks a box to accept them, and your privacy note appears under the form.

Step 9: Paid plans with Cashier (optional)

Install Cashier 1.2 or newer, connect Stripe and create your plans. Sign-up detects Cashier automatically, and Sign-up → Paid plans (Cashier) tells you whether plans are offered and, if not, why (no license, Stripe not connected, no visible plan). Choose Free accounts and paid plans or Paid plans only under Registration. The visitor picks a plan, fills in the form, confirms the address and pays with Stripe; the account is created and activated as soon as the payment is confirmed, with the plan's quota and groups, and the visitor is signed in. A plan's direct link from Cashier opens the page with that plan chosen.

When a monthly invoice is not paid, the account is suspended after Cashier's grace period (which can be 0 days): nobody can sign in, but files and data stay exactly as they are. Paying restores it immediately. Users are e-mailed when an invoice is issued, when a payment fails, when the account is suspended (with a link to pay), when it is paid and when it is active again. Accounts are never deleted for an unpaid invoice — only an administrator deletes accounts. In Sign-up → Paid plans → When a monthly invoice is not paid you can follow Cashier's rule instead.

Tips and troubleshooting

• No "Create an account" link? Check that registration is open and the license shows Active. Without a valid license the link is hidden by design.
• Nobody receives codes? Fix the mail server first; everything in Sign-up depends on it.
• License checks: the license is verified once a day. Without internet, Sign-up keeps working for 7 days after the last successful check.
• Clean-up: the only automatic removal concerns registrations that never got an account (address never confirmed, payment never made). If a payment arrives after the registration expired, the account is still created and the user gets a link to set a password.
• Overdue invoice lost? The registration page links to Cashier's Pay an overdue invoice page, which e-mails the link again.
• Approval feels slow? Rejections and approvals both send an e-mail; use the reason field so people know what to fix.

Conclusion

Self-registration in Nextcloud does not have to be an all-or-nothing switch. With Sign-up you get a real confirmation step, an approval queue you can trust, a form that matches your community, sane defaults for quota and groups, and anti-abuse that does not leak who already has an account. Add Cashier later if you want to sell plans, and remember that unpaid invoices suspend rather than delete. Start from the product page, follow the guide for every setting, and check the changelog before upgrading. Questions? The knowledge base, the FAQ and contact are there for you.