Auth Integration

AscendKit gives your users sign-in, sessions, social login, and route protection. You integrate through three surfaces — the SDK, the CLI, and the portal — and never have to call backend endpoints or manage auth infrastructure yourself.

This page maps each surface to what it's for. Follow the links for step-by-step guides.

Add auth to your app — Next.js SDK

The JavaScript SDK provides the sign-in UI, session handling, social login, and route protection. Drop in components and the provider handles the rest; auth configuration is fetched from AscendKit at runtime, so changing settings never requires a redeploy.

• Runtime setup: Next.js Integration
• Components: <Login />, <SignUp />, <AscendKitAuthCard />, <AscendKitUserButton />
• Require ToS acceptance at signup: Require Terms of Service acceptance

Using another React framework? The same components work outside Next.js — see Other React Frameworks.

Verify tokens in your backend — Python SDK

Use the Python package when your backend needs to verify access tokens issued to your frontend, or validate incoming webhook signatures.

• Token verification: Python SDK
• Webhooks: Python SDK

Configure auth behavior — CLI

Use the CLI to authenticate as a developer, link environments, and configure auth — providers, features, domain restrictions, Terms of Service — without hand-editing config files. AI coding agents can run these commands directly via the shell.

• Setup and login: CLI
• Auth configuration: CLI Auth
• Environment linking: CLI Environments

The portal exposes the same auth settings through a UI if you prefer clicking to typing.

What's automatic vs. configurable

Automatic, no setup required:

• Session issuance, storage, and refresh
• Social login redirects and the OAuth callback flow (managed credentials in dev and beta)
• Dark mode and theming of the auth UI

Configurable per environment (via CLI or portal):

• Sign-in providers — credentials, magic link, and social (google, github, apple, discord, microsoft)
• Email verification, password reset, and waitlist gating
• Session duration
• Domain allowlist and personal-domain blocking
• Terms of Service acceptance at signup
• Your own OAuth client credentials for branded consent screens

What to rely on

The stable, supported contract is the SDK components and handlers, the CLI commands and their output, and the portal UI — all described in these docs. Build against those surfaces. The backend /api/auth/* endpoints are internal implementation details that back them; don't integrate against a backend route directly unless a docs page explicitly documents it as externally supported.