Skip to main content

Feature: Auth

Tied to journey: Auth soft-gate.

Locked contract​

  • Provider: WorkOS AuthKit.
  • Methods: Apple + Google + Magic Auth (email OTP).
  • Passwords: Not supported in MVP; there is no password creation, login, reset, or recovery flow.
  • Native handoff: System browser sheet with PKCE; callback clubhouseleague://auth/callback; Android package com.pocketlabs.clubhouseleague.
  • Profile: workos_user_id, email, and display_name are required before creating a league or joining; avatar is optional.
  • Server verification: APIs verify WorkOS JWTs using WorkOS JWKS and return 401 Unauthorized for missing, invalid, expired, or unverifiable credentials.

Product acceptance criteria​

  • Soft-gate: unauthenticated users can open onboarding and browse discoverable leagues without forced login.
  • Create league, request to join, and redeem invite code require a valid authenticated session.
  • The app preserves the pending action through auth and resumes it only after required profile completion.
  • Apple, Google, and Magic Auth (email OTP) are available; no password path exists.
  • Cancelled or failed auth cannot create a league or write membership.
  • A stale-session 401 clears local session state and returns the user to the auth gate; browse/onboarding remain available.

Implementation notes​

  • AuthKit is an implementation dependency, not a top-nav product surface.
  • The client must use the system browser sheet and PKCE rather than an embedded credential form.
  • The server is the authority for identity and membership writes: use the verified WorkOS subject as workos_user_id, check the JWT against JWKS, and never trust a client-provided user ID.
  • Resume state should identify the pending action and its league or invite-code context without treating that state as authorization.
  • Ownership: Product Morgan; Eng Remy disburses to Kit/Dex; Auth contract Reed; Design Mira for this runbook only (app UI on hold).
  • Delivery tickets: iOS #3 and Android #2.