Extras and going live

Webhooks, account linking, and the checks before going live.

Link existing users (optional)

If your app already has its own users, they can link their Block-Auth identity to their account. After that, signing in with Block-Auth returns their id in your app as externalId, so you can sign them in as your user.

1. From a page where your user is signed in with your own login (and recently, for example in the last 10 minutes), send them to /blockauth/login and remember in the session that it is a link.
2. In the callback, if it is a link, pass your user id as linkExternalId when you redeem the code, and keep the user's current session:

const user = await blockauth.exchangeCode(code, CALLBACK_URL, undefined, String(req.session.appUser.id))

If that identity or user is already linked, the call fails with Account already linked or External id already linked. To remove a link from your side, call revokeLink(externalId).

Try it and go live

Open /blockauth/login, sign in, and check that you come back signed in and that GET /api/me returns your user.

Before going live:

• Your production app has its own validated domain and keys, and the site uses https.
• The apiSecret is only in your server's environment.
• The callback always checks the state, and your app creates sessions only from the address returned by /api/auth/token.
• The session cookie is HttpOnly, Secure and SameSite=Lax.