Authentication

Once Scratch authentication is complete, the privateCode is appended as a query parameter to the redirect URL.
Using this value, you can call verifySession() to validate the user session and retrieve user information and the session ID.

How to Verify the User Session

app.get("/auth", async (c) => {
  const session = c.req.query("privateCode");
  const response = await sab.verifySession(session);
  if (response.success) {
    return c.json(response);
  } else {
    return c.json(response);
  }
});

If the user session is valid and token generation succeeds, the following response will be returned:

{
  "success": true,
  "data": {
    "token": "********************************************************,
    "payload": {
      "valid": true,
      "username": "*************",
      "type": "instant",
      "redirect": "http://localhost:3000/auth"
    }
  }
}

Internal Behavior of Verification

verifySession() checks the following conditions:

• privateCode is not empty
• Communication with the external auth API is successful
• redirect_url matches
• The valid flag is true

Only if all conditions are met is the session considered authenticated.

Error Examples and Handling