ALEX STUDIO HQ / DOCUMENTATION

One Alex Studio account.
Every connected project.

Verified Google and email/password sign-ins resolve to one ecosystem identity. Each product keeps its own data.

Set up shared sign-in

Enable auth on the project.
Under Projects, select the auth feature.
Create a key with auth permission.
Existing keys do not automatically gain new permissions.
Configure shared sign-in.
Under that key’s sign-in settings, enable Google, verified email/password, or both. Add each app callback URL; up to 10 are supported. Production uses HTTPS; HTTP is allowed only on localhost or loopback IPs.

Use the assigned public client ID in the app. Never put a project API key in browser code. Email and Google methods link to the same account only when the email is verified and matches after trimming whitespace and ignoring case. Plus-addresses remain distinct.

Email and password in a browser app

Import the public auth helper from the SDK. It does not need a project API key. Email requests must include the browser’s Origin header, and the app origin must match one of the registered callback origins.

import { createAuthClient } from "https://admin.alexstudiohq.com/sdk/alex-studio-hq.js";

const auth = createAuthClient({
  clientId: "acl_YOUR_PUBLIC_CLIENT_ID",
});

const challenge = await auth.sendCode({ email: "person@example.com" });
const result = await auth.register({
  email: challenge.email,
  password: "a-long-unique-password",
  challengeId: challenge.challengeId,
  code: "123456",
  name: "Person",
});

// Existing users use the same verified email and password:
const signedIn = await auth.signIn({
  email: "person@example.com",
  password: "a-long-unique-password",
});
// Keep signedIn.access_token in your app’s protected server session.

Verification codes expire after five minutes, are single-use, and have bounded resend and attempt limits. The code is delivered by Alex Studio’s configured email service; it is never returned by the public API.

Keep Google sign-in

Google continues to return to https://staging-admin.alexstudiohq.com/auth/callback. Start the flow from your app’s backend, store state and the PKCE verifier in a short-lived server-side session, then exchange the returned code there. Your API key and verifier must never reach browser code. The gateway keeps owner administration and end-user Google sign-in separate.

The Google consent screen’s existing testing and verification rules still apply. Alex Studio verifies Google’s identity and verified email, links it to the matching canonical account, and does not store or return Google access tokens.

Existing website accounts

Existing Alex Studio email/password users can sign in with their existing verified account and password. During the first successful sign-in, the website auth service verifies those credentials and the verified-email state before linking the account. Matching email alone never proves account ownership.

Identity and data boundaries

The same canonical user ID is recognized across connected projects, but memberships and sessions remain project/client scoped. Product data is not copied or shared by account linking. Shared billing and optional AI access to selected diagnostics are not part of this implementation; they require separate explicit entitlement and data-access controls.

Opaque user tokens expire after one hour and do not grant database or administrator access. Apps must authorize access to their own user data. Blocking an account revokes its sessions across the ecosystem. Changing client settings invalidates that client’s pending requests, codes, and sessions.

Google sign-in integration

const login = await hq.auth.start({
  clientId: "acl_YOUR_PUBLIC_CLIENT_ID",
  redirectUri: "https://your-app.example/auth/callback",
});
// Keep login.state and login.codeVerifier in the app’s server session.
// Redirect the browser to login.url, then exchange the callback on the server.

External callbacks receive a single-use authorization code, not a Google token. App codes expire after 60 seconds; pending requests expire after five minutes. Both OAuth legs use S256 PKCE.

Identity API

GET /identity/authorize begins Google sign-in. POST /identity/email/send-code?client_id=…, /register, and /sign-in are public-client endpoints restricted to registered app origins. Requests without an Origin header or from an unregistered origin are rejected. The SDK helper wraps these calls. POST /v1/auth/token, /user, and /revoke are server-side endpoints that require a project key with auth permission.

Alex Studio shared sign-in is a custom API, not a complete OpenID Connect provider: refresh tokens, ID tokens, and JWKS discovery are not implemented.

One Alex Studio account.Every connected project.