Add Stackure to Your App

Stackure signs people in to your app and decides who can open it.

1. Register an app

You need to be an app admin or the owner, in an organization that isn't a subpartner. In Stackure, go to Apps and select Register App. Enter a name, your app's URL, a logo URL and the logo type. Both URLs start with https://. Your app's URL is where Stackure sends people after they sign in.

Copy the app ID and secret. The secret is shown only once. If you lose it, select Rotate Secret on the app's page. Rotating it stops every SDK still using the old one.

2. Give people access

Right after registering, select Set Up Access. Later, select Available To on the app's page. Share the app with everyone in your organization or with chosen teams. Apps never go to one person: to give someone access, add them to a team that has the app.

Everyone who signs in needs to be a user in Stackure. Invite people under Users. App admins and the owner can always open the app, so you can try sign-in before you share it.

To share it with a partner organization, open Partners on the app's page and select Share. The partner's app admins then choose who gets it. They can't pass it further down.

Your app sends people to Stackure to sign in, keeps the token Stackure hands back and checks it on each request. The SDKs do all of this for you.

What the person sees

Your app sends them to https://stackure.com/sign-in/magic-link?app_id=YOUR_APP_ID.
They enter their email. We email them a sign-in link and a 6-digit code. The link works for 15 minutes and the code for 10 minutes.
They open the link or enter the code. Stackure sends them back to your app.

If they're already signed in to Stackure in that browser, they go straight back with no email. If your app isn't available to them, they see "No Access" and stay in Stackure.

Asking for sign-in emails is limited to 3 requests per minute and 5 requests per hour for each email and IP address. Opening links and entering codes is limited to 10 requests per minute for each IP address.

What your app receives

The browser posts a form to your app's URL with one field, session_token. The token works only for your app, never for another app or for Stackure itself. Keep it in an HttpOnly cookie on your own domain. The SDKs set that cookie and redirect to the same page.

A session lasts up to 1 day. It ends sooner when the person signs out or signs in to Stackure again, since each person has one session at a time.

How your app checks it

On each request, your server asks Stackure:

GET https://stackure.com/api/public/auth/session/validate?app_id=YOUR_APP_ID
Authorization: Bearer SESSION_TOKEN
X-App-Secret: YOUR_APP_SECRET

If the session is live and the person can still open your app, you get "authenticated": true and a user with their ID, email, first and last name, organization ID, whether they're an app admin and their teams. If not, you get "authenticated": false and a sign_in_url to send them to. Session checks are limited to 1,000 requests per minute for each app.

Stackure decides who can open your app. Your app decides what they can do in it.

Sign out

Signing out ends the person's session everywhere: every app, every device and every connected AI client. Act only on a POST from your own page, so a link on another site can't sign anyone out. Call POST https://stackure.com/api/public/auth/sign-out with the token as Authorization: Bearer, then clear your cookie. Send every other sign-out request to https://stackure.com/signout, where the person confirms.

SDKs and API

Each SDK handles the handoff, checks every request and signs people out. Set these in your app's environment:

STACKURE_APP_ID=YOUR_APP_ID
STACKURE_APP_SECRET=YOUR_APP_SECRET
STACKURE_BASE_URL=https://stackure.com

Each Stackure region has its own address. This page is for https://stackure.com.

Go: net/http middleware. Zero dependencies.
JavaScript: middleware for Node.js 22 and later. Zero dependencies.
Python: ASGI and WSGI middleware. Zero dependencies.
Rust: tower middleware for axum, tonic and hyper.

To build it yourself, see the API reference.

Run it headless

Every part of Stackure runs headless through the Management API, steps 1 and 2 included: users, teams, roles, permissions, apps and their secrets, partners, partner signups, AI access, AI clients, support requests and activity. It also transfers ownership, rotates your organization's secret and shows its limits. Once your organization's access expires, every call returns 403 except your own support requests: you can still send them, list them and read them.

Its calls take your own Stackure session token, not your app's. To get one, request a sign-in link without an app ID and exchange the token in it. It lasts up to 1 day and ends sooner when you sign out or sign in to Stackure again, so a script that uses it stops working then.