Integration checklist

Use this checklist with your application’s actual browser, backend and deployment environment. Record each outcome as passed, failed, not run or not applicable.

1. First Sandbox login

• Select Sandbox and create the correct client type.
• Register the exact callback, then save the issuer, client ID and server secret.
• Enable one usable sign-in method and allow the application user to join.
• Run the reference application.
• Complete hosted sign-in and reach the verified callback.
• Log out and confirm local access ends.

Checkpoint: you have proved the basic protocol connection. A branding preview alone does not pass this stage.

2. Integrate your application

• Implement login, callback, error, signed-out and CSRF-protected logout routes.
• Validate state, PKCE, issuer, signature, audience, expiry and nonce.
• Map the verified (issuer, subject) to a unique product identity.
• Apply your admission and verified-email rules; never automatically merge by email.
• Store sessions and encrypted tokens in bounded shared storage.
• Serialize rotating refresh across concurrent requests and server instances.
• Check current session authority before allowing protected access.
• Enforce your product’s memberships, API permissions and record ownership.

Application integration · Sessions and logout

3. Add Account Security, if available

• Confirm the feature appears in the selected application’s Quickstart.
• Register a dedicated handoff callback and return destination.
• Connect the server adapter to live session validation, CSRF and atomic pending storage.
• Allow the exact authentication origin in your dashboard’s CSP form-action.
• Test a matching hosted session and a missing hosted cookie.
• Test dashboard account A with hosted account B; the wrong account must never open.
• Test expiry, account switching, cancellation, return and source-session revocation.
• Exercise actual passkey/MFA changes and recovery with the test account owner.

Account Security setup

4. Prepare Production

• Register Production separately with deployed HTTPS URLs and production credentials.
• Verify secrets are accessible to the deployed handler and absent from client bundles/logs.
• Verify current branding, delivery and each enabled external provider.
• Test refresh concurrency, revoked access, provider outages and logout failure handling.
• Test supported browsers, mobile devices and installed/offline application shells.
• Document existing-account migration and preserve issuer/hostname continuity.
• Assign deployment, incident, credential rotation and rollback ownership.

Production handoff

Measure ease of setup

For a first-time developer, record time to create the client, configure the example, complete login and logout, and integrate the first protected page. Record every undocumented step and support request.

The first-login target is 5–10 minutes once prerequisites are ready. It has not been validated by an independent timed onboarding exercise. Production session integration and existing-user migration are separate work.