ComplicatedAuth documentation

Authentication boundaries, made legible.

A code-grounded guide to the ComplicatedAuth control plane, runtime APIs, SDKs, trust boundaries, and the work still required before production rollout.

Run it locally Review implementation gaps

116OpenAPI operations

3First-party SDKs

1Management console

17Tracked findings

System at a glance

Secrets stop at the server boundary.

Browsers receive separate opaque tokens. Scoped Project service credentials and authoritative session references remain inside the customer BFF.

Request and trust boundaries

Management consoleTenant Member · HttpOnly session cookie

Customer browser@complicatedauth/browser · opaque browser tokens

ComplicatedAuth APIGo control plane + Project runtime · 116 operations

Customer BFF@complicatedauth/server · scoped service credential stays server-side

PostgreSQLTenants, projects, users, credentials, sessions

Biometric providerOptional external template service

Production readiness is not yet established.

The contract, workload credentials, delegated authorization, Support Cases, email recovery, Tenant Member phishing-resistant authentication, and bounded maintenance cleanup are verified. Biometric liveness, production origins, restore drills, production observability, and formal release compatibility gates still block a production claim.

See the audit

Choose a path

From first boot to factor policy.

Start with the product boundary you own. The console, BFF, and browser SDK each carry different credentials and responsibilities.

Operate01

Run the platform

Start PostgreSQL, the Go API, and the Next.js console, then create an isolated Project.

Local setup →

Integrate02

Connect an application

Keep a least-privilege service credential in a BFF and expose only the browser-safe authentication protocol.

SDK guide →

Assess03

Close the gaps

Work through prioritized findings with concrete evidence and completion criteria.

Status and gaps →

Minimal browser flow

Password verifies a factor. It does not finish the modern login.

After password verification, complete a passkey, hybrid, attested security-key, or facial factor. No factor-specific route issues a session independently.

const auth = new ComplicatedAuthClient({ baseUrl: "/api/auth" });

await auth.startLogin("[email protected]");
await auth.startPasswordAuth(password);
const session = await auth.startPasskeyAuth();

// session.token is browser-safe; the backend reference stays in the BFF.