# Authentication for social.chan.dev

Social is an authenticated video library and X video composer. Publishing availability is deployment-controlled; signing in or connecting an X account does not by itself enable posting.

## Human sign-in

Open https://social.chan.dev/sign-in in a browser. Auth handles sign-in using chantastic / chan.dev / Production / Web.
The callback is https://auth.chan.dev/auth/callback. A verified email address is required to use Social.
Auth and Social share an encrypted, Secure, HTTP-only session cookie with Domain=chan.dev and SameSite=Lax.
Signing into Auth grants immediate browser access to Social. All chan.dev subdomains are inside this cookie's trust boundary.
Sign out with the application's Sign out button, which submits a same-origin POST request and ends the shared browser session.

## Session inspection

GET /api/me returns the current user's ID, email, email verification status, and name when a valid browser session is present.
It returns JSON with status 401 when no session is present and status 403 when the email is unverified. It does not redirect API requests into a login flow.

## Agents

Social's public endpoints do not issue or accept agent credentials, organization API keys, or delegated publishing grants. They require the shared browser session; there is no public agent publishing API.
Credentials from Captioner do not grant access to Social. Never send WorkOS API keys or provider tokens to this site.

## Video publishing

The browser can upload reusable private MP4 originals and prepare a reviewed X video post when the media service is available. Account checking and publication are explicit user actions. A verified personal workspace, the selected personal X connection, video-upload permissions and X API availability are required in addition to browser sign-in.

Auth owns WorkOS Pipes credentials and supplies short-lived access only to the separate private Social service. Provider tokens and internal publication grants are never browser credentials. A publishing result marked unknown is not safe to retry automatically; inspect the post history and actual X account before any recovery.

## Public endpoints

- GET /health: service liveness.
- GET /auth.md: this document.