Add sign-in to a browser app without a backend

import { createSeige } from "@seige_sdk/sdk";

const seige = createSeige({ appName: "Habit tracker" });

signInButton.onclick = async () => {
  const { data: user, error } = await seige.auth.signIn();
  if (error) return showMessage(error.hint ?? error.message);
  showSignedIn(user.id);
};

const { data: current } = await seige.auth.user(); // null when signed out

How the sign-in works

seige.auth.signIn() opens a Seige window. The user signs in to Seige if needed and approves the connection to your app, then the call resolves with the user. seige.auth.user() returns the signed-in user, or null, and never opens a window. seige.auth.signOut() ends the session in this browser and keeps the user's data.

You do not need to call signIn() before using data. The first database, file or AI call that needs the user opens the same window and continues after approval. Approval is remembered in that browser, so reloads do not ask again.

• user.id is specific to your website. Two different apps see different IDs for the same person, which prevents apps from linking users by ID.
• Call seige.auth.signIn({ email: true }) to ask for the user's Seige email address. The approval window shows the request to the user.
• If the user closes the window, the call returns SIGN_IN_CANCELLED. If they decline, it returns ACCESS_DENIED.

Security properties

Seige uses OAuth with pushed authorization requests, PKCE and DPoP-bound tokens. Refresh tokens rotate on every use, and a reused refresh token revokes that browser's authorization. Seige returns the sign-in result only to a window on your app's website. Passwords are never sent to Seige's servers in readable form; account sign-in uses the OPAQUE password protocol.

Code running on your website can use the session, so protect the app against cross-site scripting as you would with any browser session.

Storage comes with the sign-in

The same connection gives your app an encrypted folder in the user's account for a database and files. Use it or ignore it; sign-in works either way.

Requirements

• An ES-module bundler that supports module workers and WebAssembly. Vite 5 to 8, Next.js 16 and webpack 5 work without configuration.
• HTTPS in production. http://localhost works for development.
• Each user needs a Seige account. Account creation is currently open to invited usernames.

Related guides

• Instructions for coding agents
• Developer documentation
• How Seige protects account data

This guide is also available as Markdown for coding agents.