SEQN Auth Hosted UI

The hosted UI is the easiest drop-in path. Your app links to SEQN Auth pages and receives users back through return_to; SEQN Auth owns hosted Google and email/password handoff, sessions, account pages, and user management.

Production base URL:

https://auth.seqn.in

Hosted routes:

/ - public landing page with signed-in Copy setup prompt
/signin
/signup
/sign-in
/sign-up
/auth/recovery
/auth/logout
/user
/organization
/auth/console

/signin and /signup are the clean public routes. /sign-in and /sign-up remain compatibility aliases for existing apps and SDK helpers.

Landing page CTA

Send developers to https://auth.seqn.in/ when they want the fastest setup. The landing page lets them select a framework icon anonymously, but it only reveals and copies the prompt after they sign in or create the workspace that should own the dashboard. The copied prompt starts with secure SEQN Auth onboarding: it can open hosted sign-in/sign-up, ask for an email only when useful for prefill, and password entry stays inside the hosted SEQN Auth page. After sign-in, it continues with CLI-style questions for project name, local app URL, and framework confirmation. The picker currently covers Next.js, React/Vite, Express, FastAPI, Django, Flask, Laravel, Rails, and generic REST API setup.

The Next.js and React prompts create in-app sign-in/sign-up windows. Express uses the JS SDK route helpers. Backend/API prompts use hosted redirects plus server-only backend health checks and do not claim native user-session middleware until the backend session exchange exists.

Build links in JavaScript

import { createHostedAuthUrls } from "@seqn/auth-js";

const hosted = createHostedAuthUrls({
  baseUrl: "https://auth.seqn.in",
  returnTo: "https://app.example.com/dashboard"
});

document.querySelector("[data-sign-in]").href = hosted.signInUrl;
document.querySelector("[data-sign-up]").href = hosted.signUpUrl;
document.querySelector("[data-account]").href = hosted.userProfileUrl;

Direct HTML links

<a href="https://auth.seqn.in/signin?return_to=https%3A%2F%2Fapp.example.com%2Fdashboard">
  Sign in
</a>
<a href="https://auth.seqn.in/signup?return_to=https%3A%2F%2Fapp.example.com%2Fdashboard">
  Create account
</a>
<a href="https://auth.seqn.in/user">Account</a>
<a href="https://auth.seqn.in/organization">Organization</a>
<a href="https://auth.seqn.in/auth/console">Console</a>

Boundaries

  • Hosted sign-in and sign-up use the SEQN Auth identity flow with Google or email/password.
  • The Continue with Google button sends the browser through the configured SEQN/Auth Google source-stage flow first, so the first visible identity prompt is Google's account chooser while SEQN Auth still owns the callback and session.
  • The email/password option sends only an email hint to Authentik: sign-in uses the configured password-capable authentication flow, and sign-up uses the configured enrollment flow. Password entry and verification stay inside the identity engine.
  • The Forgot password? link opens /auth/recovery, which redirects to Authentik's configured recovery flow and returns the browser to SEQN Auth sign-in afterward.
  • Public SaaS signup creates a tenant workspace for non-platform users.
  • /auth/console manages users, sessions, roles, invites, organizations, and project access from one hosted surface.
  • Invitation email delivery uses the Croox-backed outbox when EMAIL_ENABLED=true; without an email provider, admins can still copy the one-time invite link from the create response.
  • Payment collection, invoices, and hosted checkout are not included.