Auth delivery
Pointers for shipping the locked Auth soft-gate. Product detail lives under Product → Journeys → Auth soft-gate and Product → Features → Auth.
Locked summary
- WorkOS AuthKit: Apple + Google + Magic Auth (email OTP); no passwords
- System browser sheet + PKCE
- Android / iOS package
com.pocketlabs.clubhouseleague - Soft gate: browse signed-out; auth before create / request-join / redeem code
- Profile before gated write:
workos_user_id,email,display_name(avatar optional)
Staging AuthKit (locked)
| Item | Staging | Production |
|---|---|---|
| Client ID | client_01M2VWKF87Q557H9D37BFKC52H | Exists in WorkOS; value not published here. Prod mutations locked until billing — do not point prod builds at staging. |
| Redirect / callback | clubhouseleague-staging://auth/callback (default) | clubhouseleague://auth/callback |
| Logout / returnTo | clubhouseleague-staging://signed-out (default) | clubhouseleague://signed-out |
| Methods | Magic Auth + Google + Apple on; passwords off | Same product contract |
| Package | com.pocketlabs.clubhouseleague | Same |
Both redirect and logout URI pairs are allowlisted on WorkOS staging. Staging builds must use the staging Client ID + clubhouseleague-staging:// schemes.
Ownership
| Area | Owner |
|---|---|
| Product | Morgan |
| Auth contract / API JWKS verify | Reed |
| Mobile disbursement | Remy → Kit / Dex |
| Deep-link hosts / Universal Links (remaining OD-9) | Blake / Platform — see Ops → Auth deep-link hosts |