Sign in with
Domainless.

import jwt from 'jsonwebtoken';

// On your callback route:
app.get('/auth/domainless/callback', (req, res) => {
  const token = req.query.dl_token;
  try {
    const claims = jwt.verify(token, process.env.DOMAINLESS_JWT_SECRET, {
      algorithms: ['HS256'],
    });
    // claims = { id, email, username, ... }
    // Mint your own session, store user, redirect to app.
    req.session.user = claims;
    res.redirect('/');
  } catch (e) {
    res.status(401).send('invalid token');
  }
});

import os, jwt
from flask import request, session, redirect

@app.route('/auth/domainless/callback')
def dl_callback():
    token = request.args.get('dl_token')
    try:
        claims = jwt.decode(
            token,
            os.environ['DOMAINLESS_JWT_SECRET'],
            algorithms=['HS256'],
        )
    except jwt.InvalidTokenError:
        return 'invalid token', 401

    session['user'] = claims
    return redirect('/')

# Want to see what's inside a token without using a JWT lib?
# Just base64-decode the payload. (For prod, ALWAYS verify the signature.)
echo "<dl_token>" | cut -d. -f2 | base64 -d | jq

# {
#   "id": "abc123",
#   "email": "user@example.com",
#   "username": "spongethrob",
#   "iat": 1714665600,
#   "exp": 1717257600
# }

<!-- Drop this anywhere on your site -->
<a
  href="https://domainless.fun/authorize?redirect=https://yoursite.com/auth/domainless/callback"
  class="btn-domainless">
  Sign in with Domainless
</a>