Recipes

Task-shaped walkthroughs, each verified against a live pool:

• Sign-in for Ignite apps — start here if your app runs on Ignite. Attach a pool and every person signs in as themselves; the gateway runs the login and injects a verified identity. No auth code in the app.
• Keep each customer’s data separate — what the platform isolates for you, what your queries must, tenants, least-privilege service accounts, and a leak test checklist.
• Hosted login for an SPA — the authorization-code + PKCE flow with the hosted page: redirect out, exchange the code, brand the screens.
• Verify tokens in your backend — trust a pool with ~10 lines: JWKS, EdDSA, iss + aud, roles and permissions.
• Own your user store — move a pool’s users into your K3 bucket, live, and query them over the pg wire.

For the raw surfaces these recipes compose, see the Issuer API and the CLI Guide.