Quickstart

This walkthrough takes a new Dylog app or backend from zero to authenticated requests.

1. Get your origin allowlisted

Accounts only returns users to origins it knows. Ask a staff engineer to add your app's exact origin (scheme + host + port, no wildcards) to RETURN_TO_ORIGINS for the environment you target. The same list drives CORS for /api/auth/*.

2. Send people to sign in

Link or redirect to:

https://accounts.dylog.ai/sign-in?next=https://yourapp.dylog.ai/after-login

After a successful sign-in accounts redirects back to next. Sign-out and account settings work the same way: /sign-out?next=…, /account?next=…. See Hand-off.

3. Read the session in your browser app

If your app lives on the same site (*.dylog.ai, or *.dyloginc.workers.dev today) the session cookie is already there. Use the Better Auth client pinned to the same version as accounts:

import { createAuthClient } from "better-auth/react";
import { organizationClient, jwtClient } from "better-auth/client/plugins";

export const authClient = createAuthClient({
  baseURL: "https://accounts.dylog.ai",
  fetchOptions: { credentials: "include" },
  plugins: [organizationClient(), jwtClient()],
});

const { data: session } = await authClient.getSession();

For server-side checks forward the cookie header to GET /api/auth/get-session. See Sessions.

4. Call backends with a JWT

Browser apps fetch a token for the organization the user is working in and send it as a bearer token:

const { token } = await fetch("https://accounts.dylog.ai/api/token?org=ssd", {
  credentials: "include",
}).then((r) => r.json());

await fetch("https://gateway.dylog.ai/orders", { headers: { Authorization: `Bearer ${token}` } });

Backends verify the token against https://accounts.dylog.ai/api/auth/jwks, pin RS256, check iss and aud, and read the tenant from org_meta["client-code"]. Copy-paste verifiers for Node, Spring and Go are in JWTs.

That is the whole integration. Services and scripts without a browser use API keys to obtain the same JWT.