Single sign-on and logout
How one passkey touch signs users in to all your apps, how to check silently whether someone's signed in, and how to sign them out.
When someone signs in, Gatekeep sets a session cookie on its own domain that lasts 30 days and slides forward while it’s used. Any of your apps that sends that browser to /authorize gets a code straight back, with no passkey prompt. That’s single sign-on.
Silent sign-in: prompt=none
Add prompt=none to /authorize to ask “is this browser already signed in?” without showing anything.
- Signed in: Gatekeep redirects back with a
code, as usual. - Not signed in: Gatekeep redirects back with
error=login_required. Show your own sign-in button.
Good for landing pages that should recognise returning users.
Always ask: prompt=login
Add prompt=login before something sensitive, like changing a payout account. Gatekeep ignores the existing session and asks for a passkey again.
prompt=none and prompt=login together is an error.
Signing out
Signing out has two parts:
- Your app’s session. Clear your own cookie. The user is out of your app, but still signed in to Gatekeep, so the next “Sign in” is instant.
- The Gatekeep session. To sign them out everywhere on this browser, send them to
/logout:
https://acme.gatekeepauth.com/logout?post_logout_redirect_uri=https://app.yourapp.com/
Gatekeep ends the session and sends them to post_logout_redirect_uri if it belongs to one of your registered apps. Otherwise it shows a “Signed out” page.