Cross-App Shared Auth

A repeatable blueprint for connecting a family of apps to one shared identity plus one central accounts database, so:

• a person has a single account across every app (sign in once, known everywhere),
• access to each app is granted per app, on demand, and accrues over time (not all-or-nothing),
• users can sign up from any app OR from a central landing page, and either path registers them centrally.

Use it two ways: to stand up the platform the first time, and to onboard each new app after that. When onboarding, follow the sequence in references/onboarding-checklist.md step by step.

The one idea to hold onto

Identity is shared. Entitlement is per app. These are two independent layers, and conflating them is the mistake that causes almost every problem in this space.

• Identity (who is this person): one shared auth provider issues one stable user id used by every app. Signing in on app A signs you in on app B too (SSO across subdomains). This does not grant access to app B.
• Entitlement (what may this person use): stored in a central accounts database keyed on that shared user id. Each app checks it. No record for this user and this app means no access (deny-by-default).