Your colors, copy, and account menu — not a generic login wall. Password and email-code paths that feel like part of the product.
Shared package — not a one-off paste that drifts between client sites.
Password users, code-only users, and deep links back into the app they left.
Email lookup, then password or code — same flow families already know from modern apps.
Passwordless accounts get a clear code path instead of a dead-end error.
Optional Google (and friends) with a site-owned callback — users stay on your domain.
Drop Cloudflare Turnstile (or similar) on continue / submit without forking the kit.
After sign-in, send people back to the page they were trying to open — on allowlisted hosts only.
Shared auth UI; each site only owns config + token colors.
Three site-owned pieces. Everything else comes from the package.
01
Drop in the shared auth package and wrap your app with the kit provider.
02
Set site name, routes, after-sign-in URLs, and which hosts may deep-link back.
03
Paint brand tokens — buttons, focus rings, shell — so login matches the rest of the site.
Same kit — different brands.
Tell us the site — we wire the kit, tokens, and return paths so staff and families never see a generic auth wall.