Auth SDK

Setup in the dashboard: User Authentication

Visitor sign-in on published sites. Requires the User Authentication website feature. Visitors authenticate with Sign in with Webstorio — a platform OAuth flow scoped to your project. After sign-in, a site session cookie is set for your subdomain (and custom domain when configured).

signInWithWebstorio(returnTo?)

Start the sign-in flow. Redirects the browser to Webstorio OAuth; no return value.

// Default redirect after sign-in comes from auth config
window.webstorio.signInWithWebstorio();

// Return to a specific path after sign-in
window.webstorio.signInWithWebstorio("/account");

Parameter	Description
`returnTo`	Optional path on your site (e.g. `"/"` or `"/store/orders"`)

Use on sign-in pages and “Sign in” buttons. If getSession() already returns a user, redirect to getAuthConfig().redirectAfterSignIn instead of showing the button.

getSession()

Get the current visitor session, or null if not signed in.

const session = await window.webstorio.getSession();

if (session?.user) {
  console.log(session.user.email, session.user.name);
  console.log(session.expiresAt);
}

Returns:

{
  user: {
    id: "...",
    email: "[email protected]",
    name: "Alex",
    image: "https://...",
    emailVerified: true
  },
  projectId: "...",
  websiteId: "...",
  expiresAt: "2026-06-13T12:00:00.000Z"
}

Sends credentials (include) — the session cookie must be present.

getCurrentUser()

Shorthand for getSession() then return user or null.

const user = await window.webstorio.getCurrentUser();
if (!user) {
  window.location.href = "/auth/sign-in";
}

getAuthConfig()

Public auth settings for your site.

const config = await window.webstorio.getAuthConfig();
// {
//   signInPath: "/auth/sign-in",
//   redirectAfterSignIn: "/",
//   provider: "webstorio",
//   branding: { ... } | null
// }

Use signInPath for links to your sign-in page and redirectAfterSignIn when a signed-in visitor lands on the sign-in page.

signOut()

End the current site session.

await window.webstorio.signOut();
// { success: true }

Call from account pages or a header “Sign out” control. Then redirect or refresh UI as needed. Sign-in redirects and OAuth callbacks are handled automatically on your site’s origin. You do not configure callback URLs in page code.

Common patterns

Protect a page

const user = await window.webstorio.getCurrentUser();
if (!user) {
  const { signInPath } = await window.webstorio.getAuthConfig();
  window.location.href = signInPath + "?returnTo=" + encodeURIComponent(location.pathname);
  return null;
}

Prefill checkout (with Online Store)

const session = await window.webstorio.getSession();
const email = session?.user?.email ?? "";

Order history

Requires Online Store and a signed-in session. See Store SDK.

const { orders } = await window.webstorio.getMyOrders({ limit: 20 });

User guide

Dashboard setup: User Authentication

Overview

CLI

Client SDK

MCP Server

Help

signInWithWebstorio(returnTo?)

getSession()

getCurrentUser()

getAuthConfig()

signOut()

Common patterns

Protect a page

Prefill checkout (with Online Store)

Order history

User guide

​signInWithWebstorio(returnTo?)

​getSession()

​getCurrentUser()

​getAuthConfig()

​signOut()

​Common patterns

​Protect a page

​Prefill checkout (with Online Store)

​Order history

​User guide

signInWithWebstorio(returnTo?)

getSession()

getCurrentUser()

getAuthConfig()

signOut()

Common patterns

Protect a page

Prefill checkout (with Online Store)

Order history

User guide