One SDK.
A clear contract.

Client configuration

Construct MagnexisAuth with the exact identity issuer and redirect URI registered for your client. The SDK uses OIDC discovery and PKCE automatically.

import { MagnexisAuth } from '@magnexis/identity';

const auth = new MagnexisAuth({
  issuer: 'https://YOUR_AUTH_HOST/realms/magnexis',
  clientId: 'client-id-from-magnexis',
  redirectUri: 'https://your-website.example/auth/callback',
  postLogoutRedirectUri: 'https://your-website.example/',
  scope: 'openid profile email',
});

Core methods

Render a sign-in control

Initiate sign-in only after user interaction. Sign-in sends the browser to the identity provider; the current app never collects Magnexis passwords.

const button = document.getElementById('magnexis-signin');
button.addEventListener('click', async () => {
  try {
    await auth.signIn();
  } catch (error) {
    console.error('Could not begin sign-in', error);
  }
});
// Your callback route executes await auth.handleCallback().

Session safety

For the browser demonstration, the SDK stores transient authorization state and session data in sessionStorage, not permanent localStorage. Tokens remain accessible to JavaScript, so an XSS flaw can compromise a session. For sensitive systems, prefer a backend-for-frontend exchanging codes on a trusted server and issuing HttpOnly, Secure, SameSite cookies. Never treat a decoded ID token as authorization for a backend API; validate tokens server-side against issuer, audience, signature, and expiry.