Authentication

Let Authie own the session lifecycle.

Authie handles sign-up, sign-in, verification, recovery, callbacks, refresh, and logout. Applications verify short-lived, application-bound session tokens.

Use a first-party SDK when one is available. Next.js applications use @authie/nextjs; React applications use @authie/react. Do not add an application-owned Authie callback route to a new integration.

Frontend API flow

Enroll the application.Run npx @authie/cli init to register exact origins and configure the correct SDK.
Start authentication through the SDK.The browser SDK creates and protects the PKCE transaction.
Complete authentication at Authie.Authie validates the callback, membership, and application policy before establishing the browser session.
Receive a short-lived session token.The token is bound to the intended application and environment.
Authorize on the server.Use auth().protect() or @authie/backend for every protected operation.

Session and token rules

Never put AUTHIE_SECRET_KEY in browser code.
Never store session or refresh tokens in browser storage.
Never use an ID token as an API bearer token.
Enforce roles and permissions on the server; client guards are presentation only.
Reject tokens for another issuer, audience, application, environment, or authorized party.
Treat Authie unavailability separately from signed-out and forbidden responses.

Standards-only integrations

Applications without a first-party Authie adapter may use a maintained OIDC library with Authorization Code and S256 PKCE. Discover endpoints from the realm issuer rather than hard-coding them.

Issuer
https://authie.ai/r/<realm-id>

Discovery
https://authie.ai/.well-known/openid-configuration/r/<realm-id>

The standards-only application owns its local integration boundary and must validate issuer, audience, signature, expiration, nonce, state, PKCE, and authorized-party claims. For supported web stacks, prefer the SDK quickstart.