React SPA Example

Reference implementation for client-side authorize redirect with backend token exchange.

Install

npm install @last1id/sdk@0.3.0 @last1id/login-button@0.1.3

Issuer

Use https://auth.last1.id. client_id is Copy Client ID (UUID) or the App ID slug.

Recommended architecture

• Frontend:
• Last1LoginButton for redirect.
• Store PKCE verifier in session storage.
• Backend:
• Exchange code using exchangeCode() with client secret.
• Return app session token to SPA.

Security note

Do not ship client secret in browser bundles. Public SPA should perform token exchange through backend.