> ## Documentation Index
> Fetch the complete documentation index at: https://docs.webstorio.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth SDK

> window.webstorio authentication methods — Sign in with Webstorio, sessions, and sign-out on published sites.

<Note>
  **Setup in the dashboard:** [User Authentication](/guides/user-authentication)
</Note>

Visitor sign-in on published sites. Requires the **User Authentication** website feature.

Visitors authenticate with **Sign in with Webstorio** — a platform OAuth flow scoped to your project. After sign-in, a **site session** cookie is set for your subdomain (and custom domain when configured).

## signInWithWebstorio(returnTo?)

Start the sign-in flow. Redirects the browser to Webstorio OAuth; no return value.

```javascript theme={"dark"}
// Default redirect after sign-in comes from auth config
window.webstorio.signInWithWebstorio();

// Return to a specific path after sign-in
window.webstorio.signInWithWebstorio("/account");
```

| Parameter  | Description                                                  |
| ---------- | ------------------------------------------------------------ |
| `returnTo` | Optional path on your site (e.g. `"/"` or `"/store/orders"`) |

Use on sign-in pages and "Sign in" buttons. If `getSession()` already returns a user, redirect to `getAuthConfig().redirectAfterSignIn` instead of showing the button.

## getSession()

Get the current visitor session, or `null` if not signed in.

```javascript theme={"dark"}
const session = await window.webstorio.getSession();

if (session?.user) {
  console.log(session.user.email, session.user.name);
  console.log(session.expiresAt);
}
```

Returns:

```javascript theme={"dark"}
{
  user: {
    id: "...",
    email: "visitor@example.com",
    name: "Alex",
    image: "https://...",
    emailVerified: true
  },
  projectId: "...",
  websiteId: "...",
  expiresAt: "2026-06-13T12:00:00.000Z"
}
```

Sends credentials (`include`) — the session cookie must be present.

## getCurrentUser()

Shorthand for `getSession()` then return `user` or `null`.

```javascript theme={"dark"}
const user = await window.webstorio.getCurrentUser();
if (!user) {
  window.location.href = "/auth/sign-in";
}
```

## getAuthConfig()

Public auth settings for your site.

```javascript theme={"dark"}
const config = await window.webstorio.getAuthConfig();
// {
//   signInPath: "/auth/sign-in",
//   redirectAfterSignIn: "/",
//   provider: "webstorio",
//   branding: { ... } | null
// }
```

Use `signInPath` for links to your sign-in page and `redirectAfterSignIn` when a signed-in visitor lands on the sign-in page.

## signOut()

End the current site session.

```javascript theme={"dark"}
await window.webstorio.signOut();
// { success: true }
```

Call from account pages or a header "Sign out" control. Then redirect or refresh UI as needed.

Sign-in redirects and OAuth callbacks are handled automatically on your site's origin. You do not configure callback URLs in page code.

## Common patterns

### Protect a page

```javascript theme={"dark"}
const user = await window.webstorio.getCurrentUser();
if (!user) {
  const { signInPath } = await window.webstorio.getAuthConfig();
  window.location.href = signInPath + "?returnTo=" + encodeURIComponent(location.pathname);
  return null;
}
```

### Prefill checkout (with Online Store)

```javascript theme={"dark"}
const session = await window.webstorio.getSession();
const email = session?.user?.email ?? "";
```

### Order history

Requires **Online Store** and a signed-in session. See [Store SDK](/api-reference/sdk/store#signed-in-customer-orders).

```javascript theme={"dark"}
const { orders } = await window.webstorio.getMyOrders({ limit: 20 });
```

## User guide

Dashboard setup: [User Authentication](/guides/user-authentication)