Add Stackure to Your App

1. Register an app

You need to be an app admin or the owner, in an organization that isn't a subpartner. In Stackure, go to Apps and select Register App. Enter a name and your app's URL, which starts with https://. It's where Stackure sends people after they sign in. To sign in on your own computer, see Sign in on localhost.

Copy the app ID and secret. The secret is shown only once. If you lose it, select Rotate Secret on the app's page. Rotating it stops every SDK still using the old one.

2. Give people access

Right after registering, select Set Up Access. Later, select Available To on the app's page. Share the app with everyone in your organization or with chosen teams. Apps never go to one person: to give someone access, add them to a team that has the app.

Everyone who signs in needs to be a user in Stackure. Invite people under Users. App admins and the owner can always open the app, so you can try sign-in before you share it.

To share it with a partner organization, open Partners on the app's page and select Share. The partner's app admins then choose who gets it. They can't pass it further down.

3. Add sign-in

Your app sends people to Stackure to sign in, keeps the token Stackure hands back and checks it on each request. The SDKs do all of this for you.

What the person sees

1. Your app sends them to YOUR_REGION_URL/sign-in/magic-link?app_id=YOUR_APP_ID.
2. They enter their email. We email them a sign-in link and a 6-digit code. The link works for 15 minutes and the code for 10 minutes.
3. They open the link or enter the code. Stackure sends them back to your app.

If they're already signed in to Stackure in that browser, they go straight back with no email. If your app isn't available to them, they see "No Access" and stay in Stackure.

Asking for sign-in emails is limited to 3 requests per minute and 5 requests per hour for each email and IP address. Opening links and entering codes is limited to 10 requests per minute for each IP address.

What your app receives

The browser posts a form to your app's URL with one field, session_token. The token works only for your app, never for another app or for Stackure itself. Keep it in an HttpOnly cookie on your own domain. The SDKs set that cookie and redirect to the same page.

A session lasts up to 1 day. It ends sooner when the person signs out or signs in to Stackure again, since each person has one session at a time.

Sign in on localhost

To try sign-in on your own computer, select Development Secret on the app's page and use that secret in place of the app secret. With an SDK on localhost or 127.0.0.1, Stackure sends people back to the page they started on, over plain HTTP. Only app admins of your organization can sign in this way, and the development secret works nowhere else. Each SDK page has the details.

How your app checks it

On each request, your server asks Stackure:

GET YOUR_REGION_URL/api/public/auth/session/validate?app_id=YOUR_APP_ID
Authorization: Bearer SESSION_TOKEN
X-App-Secret: YOUR_APP_SECRET

If the session is live and the person can still open your app, you get "authenticated": true and a user with their ID, email, first and last name, organization ID, whether they're an app admin and their teams. If not, you get "authenticated": false and a sign_in_url to send them to. Session checks are limited to 1,000 requests per minute for each app.

Stackure decides who can open your app. Your app decides what they can do in it.

Sign out

Signing out ends the person's session everywhere: every app, every device and every connected AI client. Act only on a POST from your own page, so a link on another site can't sign anyone out. Call POST YOUR_REGION_URL/api/public/auth/sign-out with the token as Authorization: Bearer, then clear your cookie. Send every other sign-out request to YOUR_REGION_URL/signout, where the person confirms.

SDKs and API

Each SDK handles the handoff, checks every request and signs people out. Set these in your app's environment:

STACKURE_APP_ID=YOUR_APP_ID
STACKURE_APP_SECRET=YOUR_APP_SECRET
STACKURE_BASE_URL=YOUR_REGION_URL

Each Stackure region has its own address: https://eu-stage.stackure.com or https://us-stage.stackure.com. Use the region where your organization was created.

• Go: net/http middleware. Zero dependencies.
• JavaScript: middleware for Node.js 22 and later. Zero dependencies.
• Python: ASGI and WSGI middleware. Zero dependencies.
• Rust: tower middleware for axum, tonic and hyper.

To build it yourself, see the API reference.

Run it headless

Every part of Stackure runs headless through the Management API, steps 1 and 2 included: users, teams, roles, permissions, apps and their secrets, partners, partner signups, AI access, AI clients, support requests and activity. It also transfers ownership, rotates your organization's secret and shows its limits. Once your organization's access expires, every call returns 403 except your own support requests: you can still send them, list them and read them.

Its calls take your own Stackure session token, not your app's. To get one, request a sign-in link without an app ID and exchange the token in it. It lasts up to 1 day and ends sooner when you sign out or sign in to Stackure again, so a script that uses it stops working then.