Loading…
Loading…
Most AI builders ship “log in with Google.” Archiet ships Google, GitHub, Microsoft, custom OIDC, and (on Enterprise) SAML 2.0, Okta, Azure AD — with PKCE, encrypted tokens, account-linking, and provider failover.
Triggered by the auth.universal capability, by mentions of “log in with” or “SSO” in functional requirements, or by an enterprise compliance overlay.
No implicit flow. PKCE everywhere. State + nonce CSRF protection. The defaults match what an OAuth security review would actually pass.
Refresh and access tokens are encrypted with the workspace ENCRYPTION_MASTER_KEY before they touch the database. No bare tokens in oauth_connections.
Auto-refreshes on 401 and retries the original call. Customers don’t see avoidable re-auth prompts, and your code path stays clean.
Users who signed up via email can later link Google, GitHub, or any other provider. The same email across providers is reconciled into one identity.
If Google’s userinfo endpoint times out three times, the chain attempts the next linked provider for that user. The session survives a provider outage.
Workspace owners configure their own client IDs and secrets. The generator never hardcodes a provider key — every value comes from environment or per-workspace credentials.
OAuth handler, callback, refresh helper, account-link, and unlink emitted in your stack’s native language — not as a Python sidecar.
Where this generator answers a procurement question on day one.