@minutework/web-auth

Tenant-domain browser SDK for MinuteWork-hosted customer auth and app APIs.

import { createMinuteWorkClient } from "@minutework/web-auth";

const mw = createMinuteWorkClient({ appId: "tenant_app" });

await mw.auth.signup({ email, password, displayName, claimRef });
await mw.auth.signUp({ email, password, displayName, claimRef });
await mw.auth.login({ email, password });
await mw.auth.signInWithPassword({ email, password });
await mw.auth.verifyEmail({ token });

const session = await mw.auth.getSession();
const projects = await mw.query("listProjects", { filters: {} });
await mw.action("createProject", { data: { name: "Example" } }, { idempotencyKey });

The SDK uses same-origin /_mw routes with credentials: "include". It never exposes bearer tokens or runtime dispatch credentials to browser JavaScript. The only readable browser token is the non-secret CSRF cookie used for X-CSRFToken.

The signUp and signInWithPassword aliases are Supabase-style ergonomics for the same cookie-backed web customer session. They do not return access or refresh tokens. Native/mobile clients use @minutework/native-auth, where the same signInWithPassword name returns a native access/refresh token pair instead.

Security guidance for tenant web apps:

• Serve the app and /_mw gateway routes from the same tenant domain.
• Keep the Django session cookie host-only, HttpOnly, Secure, and SameSite=Lax.
• Add a CSP that blocks inline script by default and only allows trusted script origins.
• Treat XSS as session compromise: the cookie is HttpOnly, but malicious same-origin script can still ride the customer session and submit CSRF-protected requests.
• Do not proxy runtime APIs directly from the browser. Use the SDK routes so the platform gateway can validate the customer session and dispatch an actor context to the runtime.