Overview

The application and provider have separate sessions. The Python client reads and writes the application's session; the provider handles its authentication screens and session.

Following a login

Construct Authenticator early in each request before sending output. Ordinary requests restore the user from stored session data.

login() creates a token, saves it, and redirects to the provider with an encrypted message and deployment ID. The return destination defaults to the current URI. set_return_uri() configures another route before login. The provider validates that destination against the configured client origin.

The provider returns an AUTHWAVE_RESPONSE_DATA query parameter. The client decrypts it with the stored token, saves the user, runs the authentication callback and redirects to remove the parameter and restore the saved query. The next request reads the stored identity.

The objects we work with

Authenticator coordinates login, logout and user access. AuthUser is an immutable snapshot of ID and email. Token, SessionData, response data and provider URI helpers support the exchange. Runtime adapters connect these objects to server-side storage and HTTP redirects. See Sessions and redirects and API reference.

The provider and the application

Register a provider deployment for each environment and keep its complete client key on the server. The provider determines how users authenticate; the application associates the resulting identity with local records and checks permissions.

---

Next, see Quick start guide.