Build with an agent

Give your coding agent the integration path and a definition of success before asking it to add authentication. This avoids a common wrong turn: implementing password storage and login forms when the application is meant to use Udibo's hosted pages.

Give it this starting context

Replace the bracketed values, then copy this brief. Supply secret variable names, never credential values.

Text

Add authentication to this application using Udibo Identity.

Integration path: managed identity service.
Framework and runtime: [framework, runtime, and versions].
Application backend: [entrypoint and routing conventions].
Development origin and callback: [exact URLs].
Issuer configuration: [environment variable name].
Client ID/secret configuration: [server-side variable names].
Session persistence: [existing storage, or a decision to make].
Existing identity mapping: [app user ID and current provider, if migrating].
Authorization: [which records belong to a user or organization].

Read https://www.udibo.com/llms.txt first.
Read https://www.udibo.com/docs/identity/get-started and
https://www.udibo.com/docs/oauth2/guides/use-udibo.
Use the documented exports and checked examples. Ask for missing setup values.
Keep tokens and client secrets on the backend. Preserve PKCE, state, and CSRF.
Prove sign-in, refresh, logout, and refusal of unauthorized API requests.
Report remaining app-owned storage and deployment work explicitly.

For app-owned authentication, change the path in the brief and start with the package quickstart, Add login, and application deployment. That path includes operating user storage, credentials, delivery, and protections.

Public sources it can fetch

Resource	Use it for
Site index	All published guides and comparisons, with absolute links
Service index	The hosted-service reading order
Full service guides	The public service material in one text response
Package index	Package integration rules and guide selection
Full package docs	The package corpus in one text response
Typed package reference	Exported subpaths and exact API signatures
Management API reference	Published HTTP operations; check the service guide's availability notes too

Start with the index and fetch only the relevant pages when context is limited. The full-text resources are useful when the agent needs to compare behavior across guides. None requires access to Udibo's internal documentation.

Integration rules

A managed-service client consumes identity; it does not implement token issuance or the tenant's password and MFA pages
Browser session state is for presentation. Protect the API independently
Validate issuer, audience, expiry, and signature or introspection state before trusting token claims
A scope, a permission, and an organization membership are different things; follow the concepts guide
Use actual exported package subpaths. A declare const in a guide marks an application-owned dependency that still needs implementation
In-memory stores are development fixtures. Test a production session adapter's atomic update and revocation behavior with the package's contract tests
Preserve the previous identity provider and identity mapping during a migration until rollback has been rehearsed
Do not infer a public hosted endpoint, provisioning ability, pricing promise, or enterprise feature from a package interface or an API operation's name

Ask for evidence at handoff

The agent should show which callback and protected routes changed, where secrets and sessions live, which checks passed, and what needs deployment configuration. Have it verify a successful login, a signed-out refusal, insufficient authority, access to another user's record, refresh after expiry, and logout.

Next: Connect your first application or move an existing app.

Last verified 2026-09-06.