SDKs, REST endpoints, webhook payloads, and HMAC verification — the technical reference for sovereign login, Sign It, and real-time webhooks.
Four ready-to-copy starting points — login, agent linking, Vault identity, and file signing. Real-time webhooks and more are covered in their own sections.
Add "Sign in with Flowsta" with the @flowsta/auth SDK:
import { FlowstaAuth } from '@flowsta/auth';
const auth = new FlowstaAuth({
clientId: 'your_client_id',
redirectUri: 'https://yourapp.com/auth/callback'
});
auth.login(); // Redirects to login.flowsta.com
const user = await auth.handleCallback();
console.log('Welcome,', user.displayName);Link your app's agent key with the user's Flowsta Vault identity:
import { linkFlowstaIdentity } from '@flowsta/holochain';
const result = await linkFlowstaIdentity({
appName: 'YourApp',
clientId: 'your_client_id',
localAgentPubKey: myAgentKey,
});
// Commit attestation to your DHT
await appWebsocket.callZome({
role_name: 'my-role',
zome_name: 'agent_linking',
fn_name: 'create_direct_link',
payload: {
other_agent: decodeHashFromBase64(result.payload.vaultAgentPubKey),
other_signature: base64ToSignature(result.payload.vaultSignature),
},
});Manage Flowsta Vault identity in Tauri desktop apps:
import { FlowstaVaultAuth } from '@flowsta/auth-tauri';
const vault = new FlowstaVaultAuth();
const status = await vault.getStatus();
if (status.unlocked) {
const identity = await vault.getIdentity();
console.log('DID:', identity.did);
console.log('Agent key:', identity.agentPubKey);
}Sign files and verify signatures with the @flowsta/auth SDK:
import { FlowstaAuth, hashFile } from '@flowsta/auth';
const flowsta = new FlowstaAuth({
clientId: 'your_client_id',
redirectUri: 'https://yourapp.com/callback',
scopes: ['profile', 'sign'],
});
// Hash client-side, sign via API
const hash = await hashFile(file);
const result = await flowsta.signFile({
fileHash: hash,
intent: 'authorship',
contentRights: { license: 'cc-by', aiTraining: 'not_allowed' },
});Traditional auth services store user data in centralized databases — single points of failure vulnerable to breaches, censorship, and vendor lock-in. And signing the work your users create usually means managing your own keys, your own infra, and your own liability.
Flowsta bundles all three on one sovereign identity: