Turn login into paid access in minutes.

This endpoint exchanges the grant code for a session token and sets a secure cookie. Replace {YOUR_JAMAUTH_BASE_URL}, {YOUR_CLIENT_ID}, and {YOUR_CLIENT_SECRET}.

// Example: Express.js callback endpoint
// File: /api/auth/callback.js

app.get('/api/auth/callback', async (req, res) => {
  const { code, state } = req.query;

  // Exchange grant code for session token (server-to-server)
  const response = await fetch('{YOUR_JAMAUTH_BASE_URL}/.netlify/functions/resolve-grant?mode=token', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({
      client_id: '{YOUR_CLIENT_ID}',
      client_secret: '{YOUR_CLIENT_SECRET}',
      code
    })
  });

  if (!response.ok) {
    return res.status(401).send('Authentication failed');
  }

  const { session_token, exp } = await response.json();

  // Set secure first-party cookie
  // Note: If using __Host- prefix, MUST omit 'domain' and set path='/'
  const cookieName = process.env.COOKIE_NAME || '__Host-jam_session';
  const cookieOptions = {
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax',
    maxAge: (exp - Date.now() / 1000) * 1000,
    path: '/' // Required for __Host- cookies
  };
  
  // Only set domain if NOT using __Host- prefix
  if (!cookieName.startsWith('__Host-') && process.env.COOKIE_DOMAIN) {
    cookieOptions.domain = process.env.COOKIE_DOMAIN;
  }
  
  res.cookie(cookieName, session_token, cookieOptions);

  // Redirect to protected page
  res.redirect('https://api.jamauth.com/dashboard.html');
});

⚡ Quick Win: Drop-in Widget (3 minutes)

Perfect for static sites: Single script tag, zero configuration, no backend needed. The widget renders a login form, handles magic links, and auto-reveals protected content.

<!-- 1. Login gate (shown when not authenticated) -->
<div id="jamauth-gate"></div>

<!-- 2. Protected content (hidden until authenticated) -->
<div data-jamauth-protected style="display:none;">
  <h1>Welcome!</h1>
  <p>This content is only visible after login.</p>
</div>

<!-- 3. Widget script -->
<script
  src="https://app.jamauth.com/jamauth.js"
  data-client-id="YOUR_CLIENT_ID"
  data-host="https://app.jamauth.com"
  data-target="#jamauth-gate"
  data-session-endpoint="/.netlify/functions/jamauth-session"
></script>

How it works: Magic link → your callback sets first-party cookie → widget checks session same-origin → reveals content. Full widget docs →

Complete PKCE authentication flow for mobile apps. Uses expo-crypto, expo-secure-store, expo-random.

// File: src/lib/jamauth-client-native.js
// Copy from: starters/react-native/jamauth-client-native.js

import { JamAuthNative } from './jamauth-client-native';
import * as Linking from 'expo-linking';

const client = new JamAuthNative({
  clientId: '{YOUR_CLIENT_ID}',
  apiBase: '{YOUR_JAMAUTH_BASE_URL}/.netlify/functions'
});

// 1. Request Login (user enters email)
async function handleLogin(email) {
  try {
    // Generates PKCE verifier + challenge, stores verifier in SecureStore
    await client.requestLogin(email, {
      redirect: 'myapp://auth/callback' // Your app's deep link scheme
    });
    
    Alert.alert('Check Your Email', 'We sent you a magic login link.');
  } catch (error) {
    Alert.alert('Login Failed', error.message);
  }
}

// 2. Handle Deep Link (user clicks magic link)
Linking.addEventListener('url', async ({ url }) => {
  // Extract grant code from deep link
  // URL format: myapp://auth/callback?code=GRANT123&state=...
  const code = url.split('code=')[1]?.split('&')[0];
  
  if (code) {
    try {
      // 3. Exchange grant code for session token (PKCE verification)
      // Retrieves verifier from SecureStore, calls resolve-grant with code_verifier
      const { session_token, exp } = await client.resolveGrant(code);
      
      // Session token stored securely in SecureStore
      // Navigate to app home
      navigation.navigate('Home');
    } catch (error) {
      console.error('Grant resolution failed:', error);
      Alert.alert('Login Failed', error.message);
    }
  }
});

// 4. Check Session on App Launch
async function checkSession() {
  const expired = await client.isSessionExpired();
  
  if (expired) {
    // Show login screen
    navigation.navigate('Login');
  } else {
    // User has valid session
    navigation.navigate('Home');
  }
}

{
  "expo": {
    "scheme": "myapp",
    "ios": {
      "bundleIdentifier": "com.yourcompany.myapp"
    },
    "android": {
      "package": "com.yourcompany.myapp"
    }
  }
}