Skip to content
KOLDOS
Sign in
KOLDOS
Documentation menu
/

Examples and SDKs

Getting startedDraft

Sign-in and sessions

How Discord sign-in works and where the session lives.

Draft

The hosted API is a planned service with a draft specification. The local API described alongside it already exists and runs on your own machine.

KOLDOS accounts use Discord. The site never handles Discord tokens itself: the KOLDOS account service talks to Discord and gives your browser a session cookie.

How sign-in works

  1. 01YouYour browserChoose Continue with Discord on this site.
  2. 02KOLDOSYour browserSends you to the KOLDOS account service, which redirects to Discord.
  3. 03Discord OAuthDiscordYou approve access on Discord's own page. Discord returns a one-time code.
  4. 04KOLDOS backendKOLDOS serverExchanges the code with Discord server to server. The Discord token stays there.
  5. 05Secure sessionKOLDOS serverThe backend sets an HttpOnly session cookie that page scripts cannot read.
  6. 06DashboardYour browserThe site asks the backend who you are and opens the dashboard.

The Discord access token never reaches this site, and nothing about your session is kept in browser storage. The full flow is defined in the backend contract; the account service has not launched.

What the site never does

  • Receive or store the Discord access token.
  • Keep a session token or API key secret in localStorage or sessionStorage.
  • Pretend a sign-in succeeded when no account service is connected.

Session requirements

  • The session cookie is HttpOnly, Secure and SameSite=Lax, so page scripts cannot read it.
  • Requests that change state, like creating or revoking a key, also send a CSRF token.
  • Signing out ends the session on the server, not only in the browser.

The endpoints and cookie rules are specified in the backend contract in the repository (docs/backend-contract.md). The account service has not launched yet.