# Build with an agent

Give your coding agent the integration path and a definition of success before
asking it to add authentication. This avoids a common wrong turn: implementing
password storage and login forms when the application is meant to use Udibo's
hosted pages.

## Give it this starting context

Replace the bracketed values, then copy this brief. Supply secret **variable
names**, never credential values.

```text
Add authentication to this application using Udibo Identity.

Integration path: managed identity service.
Framework and runtime: [framework, runtime, and versions].
Application backend: [entrypoint and routing conventions].
Development origin and callback: [exact URLs].
Issuer configuration: [environment variable name].
Client ID/secret configuration: [server-side variable names].
Session persistence: [existing storage, or a decision to make].
Existing identity mapping: [app user ID and current provider, if migrating].
Authorization: [which records belong to a user or organization].

Read https://www.udibo.com/llms.txt first.
Read https://www.udibo.com/docs/identity/get-started and
https://www.udibo.com/docs/oauth2/guides/use-udibo.
Use the documented exports and checked examples. Ask for missing setup values.
Keep tokens and client secrets on the backend. Preserve PKCE, state, and CSRF.
Prove sign-in, refresh, logout, and refusal of unauthorized API requests.
Report remaining app-owned storage and deployment work explicitly.
```

For app-owned authentication, change the path in the brief and start with the
[package quickstart](https://www.udibo.com/docs/oauth2/quickstart),
[Add login](https://www.udibo.com/docs/oauth2/guides/add-login), and
[application deployment](https://www.udibo.com/docs/oauth2/guides/production-deployment).
That path includes operating user storage, credentials, delivery, and
protections.

## Public sources it can fetch

| Resource                                                                 | Use it for                                                                  |
| ------------------------------------------------------------------------ | --------------------------------------------------------------------------- |
| [Site index](https://www.udibo.com/llms.txt)                             | All published guides and comparisons, with absolute links                   |
| [Service index](https://www.udibo.com/docs/identity/llms.txt)            | The hosted-service reading order                                            |
| [Full service guides](https://www.udibo.com/docs/identity/llms-full.txt) | The public service material in one text response                            |
| [Package index](https://www.udibo.com/docs/oauth2/llms.txt)              | Package integration rules and guide selection                               |
| [Full package docs](https://www.udibo.com/docs/oauth2/llms-full.txt)     | The package corpus in one text response                                     |
| [Typed package reference](https://jsr.io/@udibo/oauth2/doc)              | Exported subpaths and exact API signatures                                  |
| [Management API reference](https://www.udibo.com/docs/api)               | Published HTTP operations; check the service guide's availability notes too |

Start with the index and fetch only the relevant pages when context is limited.
The full-text resources are useful when the agent needs to compare behavior
across guides. None requires access to Udibo's internal documentation.

For one authored page, use **Copy page** or **View Markdown**. The Markdown URL
is the page URL followed by `.md`, for example
[`get-started.md`](https://www.udibo.com/docs/identity/get-started.md). It
carries the same published guide with absolute links, ready to pass to your
agent. The API reference is generated from OpenAPI; use its linked specification
for machine-readable operations.

## Integration rules

- A managed-service client consumes identity; it does not implement token
  issuance or the tenant's password and MFA pages
- Browser session state is for presentation. Protect the API independently
- Validate issuer, audience, expiry, and signature or introspection state before
  trusting token claims
- A scope, a permission, and an organization membership are different things;
  follow the [concepts guide](https://www.udibo.com/docs/identity/concepts)
- Use actual exported package subpaths. A `declare const` in a guide marks an
  application-owned dependency that still needs implementation
- In-memory stores are development fixtures. Test a production session adapter's
  atomic update and revocation behavior with the package's contract tests
- Preserve the previous identity provider and identity mapping during a
  [migration](https://www.udibo.com/docs/identity/migrate) until rollback has
  been rehearsed
- Do not infer a public hosted endpoint, provisioning ability, pricing promise,
  or enterprise feature from a package interface or an API operation's name

## Ask for evidence at handoff

The agent should show which callback and protected routes changed, where secrets
and sessions live, which checks passed, and what needs deployment configuration.
Have it verify a successful login, a signed-out refusal, insufficient authority,
access to another user's record, refresh after expiry, and logout.

**Next:**
[Connect your first application](https://www.udibo.com/docs/identity/get-started)
or [move an existing app](https://www.udibo.com/docs/identity/migrate).

_Last verified 2026-09-26._