SaaSKit: Add auth to my app

SaaSKit — Hosted auth pages, managed sessions, secure logout. Purpose built. Simple where it counts

You’ll implement sign-up, login, and logout flows with secure session management and user management included. The foundation you build here extends to features like workspaces, enterprise SSO, MCP authentication, and SCIM provisioning.

See Demo

See the integration in action

Review the authentication sequence

Scalekit handles the complex authentication flow while you focus on your core product:

Full-Stack Authentication Flow

User initiates sign-in - Your app redirects to Scalekit’s hosted auth page
Identity verification - User authenticates via their preferred method
Secure callback - Scalekit returns user profile and session tokens
Session creation - Your app establishes a secure user session
Protected access - User accesses your application’s features

npx @scalekit-inc/cli setup

npm install -g @scalekit-inc/cli
scalekit setup

Paste a task that names implementing-saaskit. For example:

Use implementing-saaskit to add login, sessions, and logout.

Set up Scalekit
Section titled “Set up Scalekit”

Use the following instructions to install the SDK for your technology stack.
npm install @scalekit-sdk/node
pip install scalekit-sdk-python
go get -u github.com/scalekit-inc/scalekit-sdk-go
/* Gradle users - add the following to your dependencies in build file */ implementation "com.scalekit:scalekit-sdk-java:2.1.3"
 <dependency> <groupId>com.scalekit</groupId> <artifactId>scalekit-sdk-java</artifactId> <version>2.1.3</version> </dependency>
If you haven’t already, add your Scalekit credentials to your environment variables file:
.env
```
SCALEKIT_ENVIRONMENT_URL=<your-environment-url>
SCALEKIT_CLIENT_ID=<your-client-id>
SCALEKIT_CLIENT_SECRET=<your-client-secret>
COOKIE_ENCRYPTION_SECRET=   # openssl rand -base64 32 — encrypts the session cookie
REDIRECT_URI=http://localhost:3000/callback
```
Register redirect URLs for your app
Section titled “Register redirect URLs for your app”

You need to register redirect URLs for your application. Go to Scalekit dashboard → Authentication → Redirect URLs and configure:
- Allowed callback URLs: The endpoint where users are sent after successful authentication to exchange authorization codes and retrieve profile information. Learn more
- Initiate login URL: The endpoint in your app that redirects users to Scalekit’s /authorize endpoint. Required when authentication is not initiated from your app, for example, when a user accepts an organization invitation or starts sign-in directly from their identity provider (IdP-initiated SSO). Learn more

An authorization URL is an endpoint that redirects users to Scalekit’s sign-in page. Use the Scalekit SDK to construct this URL with your redirect URI and required scopes.

Express
Next.js

1
import express from 'express';
2
import { ScalekitAuth } from '@scalekit-sdk/node/express';
3

4
const auth = new ScalekitAuth({
5
  envUrl: process.env.SCALEKIT_ENVIRONMENT_URL,
6
  clientId: process.env.SCALEKIT_CLIENT_ID,
7
  clientSecret: process.env.SCALEKIT_CLIENT_SECRET,
8
  redirectUri: process.env.REDIRECT_URI,
9
  cookieEncryptionSecret: process.env.COOKIE_ENCRYPTION_SECRET,
10
});
11

12
const app = express();
13
app.use(auth.router);
14

15
app.get('/account', auth.requiresAuth, (req, res) => {
16
  res.json({ sub: req.scalekitUser?.sub });
17
});
18

19
app.listen(3000);

Open http://localhost:3000/account. A missing session goes to /login. After login, the visitor returns to /account. Register http://localhost:3000/callback as the dashboard Redirect URI.

1
import { ScalekitClient } from '@scalekit-sdk/node';
2
import { ScalekitAuthNext } from '@scalekit-sdk/node/next';
3

4
const scalekit = new ScalekitClient(
5
  process.env.SCALEKIT_ENVIRONMENT_URL!,
6
  process.env.SCALEKIT_CLIENT_ID!,
7
  process.env.SCALEKIT_CLIENT_SECRET!
8
);
9

10
export const auth = new ScalekitAuthNext({
11
  client: scalekit,
12
  redirectUri: process.env.REDIRECT_URI!,
13
  cookieEncryptionSecret: process.env.COOKIE_ENCRYPTION_SECRET!,
14
});

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createLoginHandler();

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createCallbackHandler();

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createLogoutHandler();

1
import { auth } from '../../lib/auth';
2

3
export const GET = auth.withAuth(async (request, { user }) => {
4
  return Response.json({ sub: user?.sub });
5
});

Open http://localhost:3000/account. A missing session goes to /login.

Flask
FastAPI

pip install "scalekit-sdk-python[flask]"

1
import os
2
from flask import Flask
3
from scalekit.frameworks.flask import ScalekitAuth
4

5
app = Flask(__name__)
6
auth = ScalekitAuth(
7
    app,
8
    env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
9
    client_id=os.environ["SCALEKIT_CLIENT_ID"],
10
    client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
11
    redirect_uri=os.environ["REDIRECT_URI"],
12
    cookie_encryption_secret=os.environ["COOKIE_ENCRYPTION_SECRET"],
13
    # HTTP localhost drops a Secure cookie, so the session never sticks.
14
    # A missing Secure flag on real HTTP lets the browser send sk_session in cleartext.
15
    cookie_secure=False,
16
)
17

18
@app.route("/account")
19
@auth.requires_auth
20
def account():
21
    return {"sub": auth.current_user["sub"]}
22

23
if __name__ == "__main__":
24
    app.run(port=3000)

Open http://localhost:3000/account. A missing session goes to /login. Register http://localhost:3000/callback as the dashboard Redirect URI.

pip install "scalekit-sdk-python[fastapi]"

1
import os
2
from fastapi import Depends, FastAPI
3
from scalekit.frameworks.fastapi import ScalekitAuth
4

5
app = FastAPI()
6
auth = ScalekitAuth(
7
    env_url=os.environ["SCALEKIT_ENVIRONMENT_URL"],
8
    client_id=os.environ["SCALEKIT_CLIENT_ID"],
9
    client_secret=os.environ["SCALEKIT_CLIENT_SECRET"],
10
    redirect_uri=os.environ["REDIRECT_URI"],
11
    cookie_encryption_secret=os.environ["COOKIE_ENCRYPTION_SECRET"],
12
    # HTTP localhost drops a Secure cookie, so the session never sticks.
13
    # A missing Secure flag on real HTTP lets the browser send sk_session in cleartext.
14
    cookie_secure=False,
15
)
16
auth.install(app)
17

18
@app.get("/account")
19
async def account(user: dict = Depends(auth.requires_auth)):
20
    return {"sub": user["sub"]}

uvicorn app:app --port 3000

Open http://localhost:3000/account. Register http://localhost:3000/callback as the dashboard Redirect URI.

1
// Must match the allowed callback URL you registered in the dashboard
2
redirectUri := "http://localhost:3000/auth/callback"
3

4
// Request user profile data (openid, profile, email) and session tracking (offline_access)
5
// offline_access enables refresh tokens so users can stay logged in across sessions
6
options := scalekit.AuthorizationUrlOptions{
7
    Scopes: []string{"openid", "profile", "email", "offline_access"}
8
}
9

10
authorizationUrl, err := scalekitClient.GetAuthorizationUrl(redirectUri, options)
11
// Generated URL will look like:
12
// https://<SCALEKIT_ENVIRONMENT_URL>/oauth/authorize?response_type=code&client_id=skc_1234&scope=openid%20profile%20email%20offline_access&redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback
13
if err != nil {
14
    // Handle error based on your application's error handling strategy
15
    panic(err)
16
}
17

18
c.Redirect(http.StatusFound, authorizationUrl.String())

1
import com.scalekit.internal.http.AuthorizationUrlOptions;
2
import java.net.URL;
3
import java.util.Arrays;
4

5
// Must match the allowed callback URL you registered in the dashboard
6
String redirectUri = "http://localhost:3000/auth/callback";
7

8
// Request user profile data (openid, profile, email) and session tracking (offline_access)
9
// offline_access enables refresh tokens so users can stay logged in across sessions
10
AuthorizationUrlOptions options = new AuthorizationUrlOptions();
11
options.setScopes(Arrays.asList("openid", "profile", "email", "offline_access"));
12

13
URL authorizationUrl = scalekit.authentication().getAuthorizationUrl(redirectUri, options);
14
// Generated URL will look like:
15
// https://<SCALEKIT_ENVIRONMENT_URL>/oauth/authorize?response_type=code&client_id=skc_1234&scope=openid%20profile%20email%20offline_access&redirect_uri=https%3A%2F%2Fyourapp.com%2Fcallback

This redirects users to Scalekit’s managed sign-in page where they can authenticate. The page includes default authentication methods for users to toggle between sign in and sign up.

Get user details from the callback

After successful authentication, Scalekit creates a user record and sends the user information to your callback endpoint. In authentication flow, Scalekit redirects to your callback URL with an authorization code. Your application exchanges this code for the user’s profile information and session tokens.

Express
Next.js

1
app.use(auth.router); // GET /callback writes sk_session

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createCallbackHandler();

Flask
FastAPI

1
auth = ScalekitAuth(app, ...)  # registers GET /callback

1
auth.install(app)  # registers GET /callback


17 collapsed lines
1
package main
2

3
import (
4
    "log"
5
    "net/http"
6
    "os"
7
    "github.com/gin-gonic/gin"
8
    "github.com/scalekit-inc/scalekit-sdk-go"
9
)
10

11
// Create Scalekit client instance
12
var scalekitClient = scalekit.NewScalekitClient(
13
    os.Getenv("SCALEKIT_ENVIRONMENT_URL"),
14
    os.Getenv("SCALEKIT_CLIENT_ID"),
15
    os.Getenv("SCALEKIT_CLIENT_SECRET"),
16
)
17

18
const redirectUri = "http://localhost:3000/auth/callback"
19

20
func callbackHandler(c *gin.Context) {
21
    code := c.Query("code")
22
    errorParam := c.Query("error")
23
    errorDescription := c.Query("error_description")
9 collapsed lines
24

25
    if errorParam != "" {
26
        c.JSON(http.StatusUnauthorized, gin.H{
27
            "error": errorParam,
28
            "error_description": errorDescription,
29
        })
30
        return
31
    }
32

33
    // Exchange the authorization code for user profile and session tokens
34
    // Returns: User (profile info), IdToken (JWT with user claims), AccessToken (JWT with roles/permissions), RefreshToken
35
    options := scalekit.AuthenticationOptions{}
36
    authResult, err := scalekitClient.AuthenticateWithCode(
37
        c.Request.Context(), code, redirectUri, options,
9 collapsed lines
38
    )
39

40
    if err != nil {
41
        log.Printf("Error exchanging code: %v", err)
42
        c.JSON(http.StatusInternalServerError, gin.H{
43
            "error": "Failed to authenticate user",
44
        })
45
        return
46
    }
47

48
    user := authResult.User
49
    // IdToken: Decode to access full user profile (sub, oid, email, name)
50
    // AccessToken: Contains roles and permissions for authorization decisions
51
    // RefreshToken: Use to obtain new access tokens when they expire
52

53
    // "user" object contains the user's profile information
54
    // Next step: Create a session and log in the user
55
    c.Redirect(http.StatusFound, "/dashboard/profile")
56
}


10 collapsed lines
1
import com.scalekit.ScalekitClient;
2
import com.scalekit.internal.http.AuthenticationOptions;
3
import com.scalekit.internal.http.AuthenticationResponse;
4
import org.springframework.web.bind.annotation.*;
5
import org.springframework.web.servlet.view.RedirectView;
6
import org.springframework.http.ResponseEntity;
7
import org.springframework.http.HttpStatus;
8
import java.util.HashMap;
9
import java.util.Map;
10

11
@RestController
12
public class CallbackController {
13

14
    private final String redirectUri = "http://localhost:3000/auth/callback";
15

16
    @GetMapping("/auth/callback")
17
    public Object callback(
18
        @RequestParam(required = false) String code,
19
        @RequestParam(required = false) String error,
20
        @RequestParam(name = "error_description", required = false) String errorDescription
21
    ) {
4 collapsed lines
22
        if (error != null) {
23
           // handle error
24
        }
25

26
        try {
27
            // Exchange the authorization code for user profile and session tokens
28
            // Returns: user (profile info), idToken (JWT with user claims), accessToken (JWT with roles/permissions), refreshToken
29
            AuthenticationOptions options = new AuthenticationOptions();
30
            AuthenticationResponse authResult = scalekit
31
                .authentication()
32
                .authenticateWithCode(code,redirectUri,options);
33

34
            var user = authResult.getIdTokenClaims();
35
            // idToken: Decode to access full user profile (sub, oid, email, name)
36
            // accessToken: Contains roles and permissions for authorization decisions
37
            // refreshToken: Use to obtain new access tokens when they expire
38

39
            // "user" object contains the user's profile information
8 collapsed lines
40
            // Next step: Create a session and log in the user
41
            return new RedirectView("/dashboard/profile");
42

43
        } catch (Exception err) {
44
            // Handle exception (e.g., log error, return error response)
45
        }
46
    }
47
}

The authResult object contains:

user - Common user details with email, name, and verification status
idToken - JWT containing verified full user identity claims (includes: sub user ID, oid organization ID, email, name, exp expiration)
accessToken - Short-lived token that determines current access context (includes: sub user ID, oid organization ID, roles, permissions, exp expiration)
refreshToken - Long-lived token to obtain new access tokens

1
{
2
  user: {
3
    email: "john.doe@example.com",
4
    emailVerified: true,
5
    givenName: "John",
6
    name: "John Doe",
7
    id: "usr_74599896446906854"
8
  },
9
  idToken: "eyJhbGciO..", // Decode for full user details
10

11
  accessToken: "eyJhbGciOi..",
12
  refreshToken: "rt_8f7d6e5c4b3a2d1e0f9g8h7i6j..",
13
  expiresIn: 299 // in seconds
14
}

1
{
2
  "at_hash": "ec_jU2ZKpFelCKLTRWiRsg",
3
  "aud": [
4
    "skc_58327482062864390"
5
  ],
6
  "azp": "skc_58327482062864390",
7
  "c_hash": "6wMreK9kWQQY6O5R0CiiYg",
8
  "client_id": "skc_58327482062864390",
9
  "email": "john.doe@example.com",
10
  "email_verified": true,
11
  "exp": 1742975822,
12
  "family_name": "Doe",
13
  "given_name": "John",
14
  "iat": 1742974022,
15
  "iss": "https://scalekit-z44iroqaaada-dev.scalekit.cloud",
16
  "name": "John Doe",
17
  "oid": "org_59615193906282635",
18
  "sid": "ses_65274187031249433",
19
  "sub": "usr_63261014140912135"
20
}

1
{
2
    "aud": [
3
      "prd_skc_7848964512134X699"
4
    ],
5
    "client_id": "prd_skc_7848964512134X699",
6
    "exp": 1758265247,
7
    "iat": 1758264947,
8
    "iss": "https://login.devramp.ai",
9
    "jti": "tkn_90928731115292X63",
10
    "nbf": 1758264947,
11
    "oid": "org_89678001X21929734",
12
    "permissions": [
13
      "workspace_data:write",
14
      "workspace_data:read"
15
    ],
16
    "roles": [
17
      "admin"
18
    ],
19
    "sid": "ses_90928729571723X24",
20
    "sub": "usr_8967800122X995270",
21
    // External identifiers if updated on Scalekit
22
    "xoid": "ext_org_123", // Organization ID
23
    "xuid": "ext_usr_456", // User ID
24
}

The user details are packaged in the form of JWT tokens. Decode the idToken to access full user profile information (email, name, organization ID) and the accessToken to check user roles and permissions for authorization decisions. See Complete login with code exchange for detailed token claim references and verification instructions.

Create and manage user sessions

The access token is a JWT that contains the user’s permissions and roles. It expires in 5 minutes (default) but can be configured. When it expires, use the refresh token to obtain a new access token. The refresh token is long-lived and designed for this purpose.

The Scalekit SDK provides methods to refresh access tokens automatically. However, you must log the user out when the refresh token itself expires or becomes invalid.

Express
Next.js

1
app.get('/account', auth.requiresAuth, (req, res) => {
2
  res.json({ sub: req.scalekitUser?.sub });
3
});

1
import { auth } from '../../lib/auth';
2

3
export const GET = auth.withAuth(async (request, { user }) => {
4
  return Response.json({ sub: user?.sub });
5
});

Flask
FastAPI

1
@app.route("/account")
2
@auth.requires_auth
3
def account():
4
    return {"sub": auth.current_user["sub"]}

1
@app.get("/account")
2
async def account(user: dict = Depends(auth.requires_auth)):
3
    return {"sub": user["sub"]}


8 collapsed lines
1
import (
2
    "net/http"
3
    "os"
4
)
5

6
// Set SameSite mode for CSRF protection
7
c.SetSameSite(http.SameSiteStrictMode)
8

9
// Store access token in HttpOnly cookie with Path scoping to API routes
10
c.SetCookie(
11
    "accessToken",
12
    authResult.AccessToken,
13
    authResult.ExpiresIn-60, // seconds in Gin
14
    "/api",
15
    "",
16
    os.Getenv("GIN_MODE") == "release",
17
    true,
18
)
19

20
// Store refresh token in separate HttpOnly cookie with Path scoped to refresh endpoint
21
c.SetCookie(
22
    "refreshToken",
23
    authResult.RefreshToken,
24
    0, // No expiry for refresh token cookie
25
    "/auth/refresh",
26
    "",
27
    os.Getenv("GIN_MODE") == "release",
28
    true,
29
)


6 collapsed lines
1
import javax.servlet.http.Cookie;
2
import javax.servlet.http.HttpServletResponse;
3

4
// Store access token in HttpOnly cookie with Path scoping to API routes
5
Cookie accessTokenCookie = new Cookie("accessToken", authResult.getAccessToken());
6
accessTokenCookie.setMaxAge(authResult.getExpiresIn() - 60); // seconds in Spring
7
accessTokenCookie.setHttpOnly(true);
8
accessTokenCookie.setSecure(true);
9
accessTokenCookie.setPath("/api");
10
response.addCookie(accessTokenCookie);
11

12
// Store refresh token in separate HttpOnly cookie with Path scoped to refresh endpoint
13
Cookie refreshTokenCookie = new Cookie("refreshToken", authResult.getRefreshToken());
14
refreshTokenCookie.setHttpOnly(true);
15
refreshTokenCookie.setSecure(true);
16
refreshTokenCookie.setPath("/auth/refresh");
17
response.addCookie(refreshTokenCookie);
18
response.setHeader("Set-Cookie",
19
  response.getHeader("Set-Cookie") + "; SameSite=Strict");

This sets browser cookies with the session tokens. Every request to your backend needs to verify the accessToken to ensure the user is authenticated. If expired, use the refreshToken to get a new access token.

Express
Next.js

1
app.get('/dashboard', auth.requiresAuth, (req, res) => {
2
  res.json({ user: req.scalekitUser });
3
});

1
import { auth } from './lib/auth';
2

3
export default auth.createMiddleware({
4
  publicRoutes: ['/'],
5
});
6

7
export const config = {
8
  runtime: 'nodejs',
9
  matcher: ['/((?!_next/static|_next/image|favicon.ico).*)'],
10
};

Flask
FastAPI

1
@app.route("/dashboard")
2
@auth.requires_auth
3
def dashboard():
4
    return {"user": auth.current_user}

1
@app.get("/dashboard")
2
async def dashboard(user: dict = Depends(auth.requires_auth)):
3
    return {"user": user}


5 collapsed lines
1
import (
2
    "context"
3
    "net/http"
4
)
5

6
// verifyToken is a middleware that ensures a valid access token or refreshes it if expired.
7
func verifyToken(next http.HandlerFunc) http.HandlerFunc {
8
    return func(w http.ResponseWriter, r *http.Request) {
9
        // Retrieve the access token from the user's cookie
10
        cookie, err := r.Cookie("accessToken")
4 collapsed lines
11
        if err != nil {
12
            // No access token cookie found; reject the request
13
            http.Error(w, `{"message": "No access token provided"}`, http.StatusUnauthorized)
14
            return
15
        }
16

17
        accessToken := cookie.Value
18

19
        // Decrypt the access token before validation
20
        decryptedAccessToken, err := decrypt(accessToken)
5 collapsed lines
21
        if err != nil {
22
            // Could not decrypt access token; treat as invalid
23
            http.Error(w, `{"message": "Token decryption failed"}`, http.StatusUnauthorized)
24
            return
25
        }
26

27
        // Validate the access token using the Scalekit SDK
28
        isValid, err := scalekitClient.ValidateAccessToken(r.Context(), decryptedAccessToken)
29
        if err != nil || !isValid {
30
            // Access token is invalid or expired
31

32
            // Attempt to retrieve the stored refresh token
33
            refreshToken, err := getStoredRefreshToken(r)
5 collapsed lines
34
            if err != nil {
35
                // No refresh token is available; cannot continue
36
                http.Error(w, `{"message": "No refresh token available"}`, http.StatusUnauthorized)
37
                return
38
            }
39

40
            // Use the refresh token to obtain a new access token from Scalekit
41
            tokenResponse, err := scalekitClient.RefreshAccessToken(r.Context(), refreshToken)
5 collapsed lines
42
            if err != nil {
43
                // Refresh attempt failed; likely an expired or invalid refresh token
44
                http.Error(w, `{"message": "Token refresh failed"}`, http.StatusUnauthorized)
45
                return
46
            }
47

48
            // Save the new refresh token so it can be reused for future requests
49
            err = storeRefreshToken(tokenResponse.RefreshToken)
5 collapsed lines
50
            if err != nil {
51
                // Could not store the new refresh token
52
                http.Error(w, `{"message": "Failed to store refresh token"}`, http.StatusInternalServerError)
53
                return
54
            }
55

56
            // Encrypt the new access token before setting it in the cookie
57
            encryptedNewAccessToken, err := encrypt(tokenResponse.AccessToken)
5 collapsed lines
58
            if err != nil {
59
                // Could not encrypt new access token
60
                http.Error(w, `{"message": "Token encryption failed"}`, http.StatusInternalServerError)
61
                return
62
            }
63

64
            // Issue a new accessToken cookie with updated credentials
31 collapsed lines
65
            newCookie := &http.Cookie{
66
                Name:     "accessToken",
67
                Value:    encryptedNewAccessToken,
68
                HttpOnly: true,
69
                Secure:   true,
70
                Path:     "/",
71
                SameSite: http.SameSiteStrictMode,
72
            }
73
            http.SetCookie(w, newCookie)
74

75
            // Mark the token as valid in the request context and proceed
76
            r = r.WithContext(context.WithValue(r.Context(), "tokenValid", true))
77
        } else {
78
            // The access token is valid; continue with marked context
79
            r = r.WithContext(context.WithValue(r.Context(), "tokenValid", true))
80
        }
81

82
        // Pass the request along to the next handler in the chain
83
        next(w, r)
84
    }
85
}
86

87
// dashboardHandler demonstrates a protected route that requires authentication.
88
func dashboardHandler(w http.ResponseWriter, r *http.Request) {
89
    w.Header().Set("Content-Type", "application/json")
90
    w.Write([]byte(`{
91
        "message": "This is a protected route",
92
        "tokenValid": true
93
    }`))
94
}
95

96
// Usage example:
97
// Attach middleware to the /dashboard route:
98
// http.HandleFunc("/dashboard", verifyToken(dashboardHandler))


6 collapsed lines
1
import javax.servlet.http.HttpServletRequest;
2
import javax.servlet.http.HttpServletResponse;
3
import javax.servlet.http.Cookie;
4
import org.springframework.web.servlet.HandlerInterceptor;
5

6
@Component
7
public class TokenVerificationInterceptor implements HandlerInterceptor {
8
    @Override
9
    public boolean preHandle(
10
        HttpServletRequest request,
11
        HttpServletResponse response,
12
        Object handler
13
    ) throws Exception {
14
        try {
15
            // Get access token from cookie
16
            String accessToken = getCookieValue(request, "accessToken");
17
            String refreshToken = getCookieValue(request, "refreshToken");
18

19
            // Decrypt the tokens
20
            String decryptedAccessToken = decrypt(accessToken);
21
            String decryptedRefreshToken = decrypt(refreshToken);
22

23
            // Use Scalekit SDK to validate the token
24
            boolean isValid = scalekit.authentication().validateAccessToken(decryptedAccessToken);
25

26

27
            // Use refreshToken to get a new access token
28
            AuthenticationResponse tokenResponse = scalekit
29
                    .authentication()
30
                    .refreshToken(decryptedRefreshToken);
31

32
            // Update the cookie with the new access token and refresh token
33
            String encryptedNewAccessToken = encrypt(tokenResponse.getAccessToken());
34
            String encryptedNewRefreshToken = encrypt(tokenResponse.getRefreshToken());
35

36
            Cookie accessTokenCookie = new Cookie("accessToken", encryptedNewAccessToken);
37
            accessTokenCookie.setHttpOnly(true);
38
            accessTokenCookie.setSecure(true);
39
            accessTokenCookie.setPath("/");
40
            response.addCookie(accessTokenCookie);
41

42
            Cookie refreshTokenCookie = new Cookie("refreshToken", encryptedNewRefreshToken);
43
            refreshTokenCookie.setHttpOnly(true);
44
            refreshTokenCookie.setSecure(true);
45
            refreshTokenCookie.setPath("/");
46
            response.addCookie(refreshTokenCookie);
47

48
            return true;
49
        } catch (Exception e) {
50
           // handle exception
51
        }
52
    }
13 collapsed lines
53

54
    private String getCookieValue(HttpServletRequest request, String cookieName) {
55
        Cookie[] cookies = request.getCookies();
56
        if (cookies != null) {
57
            for (Cookie cookie : cookies) {
58
                if (cookieName.equals(cookie.getName())) {
59
                    return cookie.getValue();
60
                }
61
            }
62
        }
63
        return null;
64
    }
65
}

Authenticated users can access your dashboard. The app enforces session policies using session tokens. To change session policies, go to Dashboard > Authentication > Session Policy in the Scalekit dashboard.

Log out the user

Session persistence depends on the session policy configured in the Scalekit dashboard. To log out a user, clear local session data and invalidate the user’s session in Scalekit.

Express
Next.js

1
<a href="/logout">Log out</a>

1
import { auth } from '../../lib/auth';
2
export const GET = auth.createLogoutHandler();

1
<a href="/logout">Log out</a>

Flask
FastAPI

1
<a href="/logout">Log out</a>

1
<a href="/logout">Log out</a>


8 collapsed lines
1
package main
2

3
import (
4
    "net/http"
5
    "github.com/gin-gonic/gin"
6
    "github.com/scalekit-inc/scalekit-sdk-go"
7
)
8

9
func logoutHandler(c *gin.Context) {
10
    // Clear all session data including cookies and local storage
11
    clearSessionData()
12

13
    // Generate Scalekit logout URL
14
    options := scalekit.LogoutUrlOptions{
15
        IdTokenHint:           idToken,
16
        PostLogoutRedirectUri: postLogoutRedirectUri,
17
    }
18
    logoutUrl, err := scalekitClient.GetLogoutUrl(options)
19
    if err != nil {
20
        c.JSON(http.StatusInternalServerError, gin.H{
21
            "error": "Failed to generate logout URL",
22
        })
23
        return
24
    }
25

26
    // Redirect to Scalekit's logout endpoint
27
    // Note: This is a one-time use URL that becomes invalid after use
28
    c.Redirect(http.StatusFound, logoutUrl.String())
29
}


5 collapsed lines
1
import com.scalekit.internal.http.LogoutUrlOptions;
2
import org.springframework.web.bind.annotation.*;
3
import org.springframework.web.servlet.view.RedirectView;
4
import java.net.URL;
5

6
@RestController
7
public class LogoutController {
8

9
    @GetMapping("/logout")
10
    public RedirectView logout() {
11

12
        clearSessionData();
13

14

15
        LogoutUrlOptions options = new LogoutUrlOptions();
16
        options.setIdTokenHint(idToken);
17
        options.setPostLogoutRedirectUri(postLogoutRedirectUri);
18

19
        URL logoutUrl = scalekit.authentication()
20
            .getLogoutUrl(options);
21

22

23
        // Note: This is a one-time use URL that becomes invalid after use
24
        return new RedirectView(logoutUrl.toString());
25
    }
26
}

The logout process completes when Scalekit invalidates the user’s session and redirects them to your registered post-logout URL.

This single integration unlocks multiple authentication methods, including Magic Link & OTP, social sign-ins, enterprise single sign-on (SSO), and robust user management features. As you continue working with Scalekit, you’ll discover even more features that enhance your authentication workflows.

SaaSKit: Add auth to my app

Build with a coding agent

Set up Scalekit

Register redirect URLs for your app

Redirect users to sign up (or) login

Get user details from the callback

Create and manage user sessions

Log out the user