Implement SaaSKit

Add login, callback, session cookies, and logout. Then stop.

Guardrails

• MUST validate tokens server-side. MUST NOT trust raw JWT claims. MUST NOT put tokens in localStorage.
• MUST keep redirectUri identical to the dashboard Allowed callback URL.
• MUST NOT write refresh middleware, remote revoke, or a session list. Name manage-saaskit-sessions instead.

Gotchas