Integrate through a BFF.

1. Server boundary

Mount one ComplicatedAuthServer instance behind a same-origin route. Give its service account only authentication.perform and sessions.manage unless this BFF also administers Project Users. A production deployment must provide a shared, TTL-backed store.

import { ComplicatedAuthServer } from "@complicatedauth/server";

const auth = new ComplicatedAuthServer({
  backendUrl: process.env.COMPLICATEDAUTH_URL!,
  projectUid: process.env.COMPLICATEDAUTH_PROJECT_UID!,
  serviceCredential: process.env.COMPLICATEDAUTH_SERVICE_CREDENTIAL!,
  store: redisReferenceStore,
});

export const GET = (request: Request) => auth.handle(request);
export const POST = (request: Request) => auth.handle(request);
export const DELETE = (request: Request) => auth.handle(request);

2. Browser flow

The browser calls only the BFF. Its opaque token is still a bearer credential, so protect the application against script injection and clear it on logout.

import { ComplicatedAuthClient } from "@complicatedauth/browser";

const auth = new ComplicatedAuthClient({ baseUrl: "/api/auth" });
await auth.startLogin(email);
await auth.startPasswordAuth(password);
const session = await auth.startPasskeyAuth();

3. Optional biometrics

The extension reuses the core client's authenticated transport. The current backend sends one image to an external provider and receives only a match decision.

import { BiometricClient, captureSelfie } from "@complicatedauth/biometrics";

const biometrics = new BiometricClient({ client: auth });
const selfie = await captureSelfie(videoElement);
const session = await biometrics.startBiometricAuth(selfie);

BFF route surface