Project Authentication is an application-user identity layer. Each project receives its own publishable key, users, identities, sessions, signing key, redirect policy, email delivery, and OAuth Apps.
#Project identity boundary
| Identity | Owner | Purpose |
|---|---|---|
| HALO account user | HALO | Access the developer dashboard |
| Project Authentication user | Your project | Sign in to your application |
| Upstream provider identity | Google, Apple, GitHub, Microsoft | Verify a project user |
| OAuth App client | Your project | Request scoped access to a signed-in project user |
#Email quickstart
- 1Configure URLs
Set the site URL and every exact redirect URL the project may use.
- 2Configure email
Add a Resend sending key, verified From address, and the three required HTML templates.
- 3Copy the publishable key
The dashboard Authentication section displays the project key used by public endpoints.
- 4Create a user session
Create the SDK client once, then sign up or sign in through
halo.auth. The SDK persists the browser session and rotates refresh tokens automatically.
import { createClient } from "agihalo-node-sdk/auth";
const halo = createClient(
"https://api.agihalo.com",
HALO_PROJECT_PUBLISHABLE_KEY
);
const { data, error } = await halo.auth.signInWithPassword({
email: "user@example.com",
password: "use-a-strong-password",
});
if (error) throw error;
// The SDK automatically sends apikey + Bearer <access_token>.
const { data: currentUser } = await halo.auth.getUser();#Public API
/api/v1/auth/settings/api/v1/auth/signup/api/v1/auth/token?grant_type=password/api/v1/auth/token?grant_type=refresh_token/api/v1/auth/user/api/v1/auth/logout/api/v1/auth/.well-known/jwks.json#Choose the next guide
Give a coding agent the complete secure integration contract.
Email & ResendConfigure password policy, sender identity, and HTML messages.
Sign-in providersRegister project-specific callbacks with four upstream providers.
Sessions & JWTValidate project-signed access tokens and rotate refresh sessions.
OAuth AppsLet a service request explicit scopes from a signed-in project user.