Briven/examples/auth-pilot

auth-pilot

Smallest trustworthy Briven Auth setup for a real browser test (dogfood kit).

For humans: follow repo root AUTH-GO-LIVE-CHECKLIST.md + BETA-V1-NEXT-STEPS.md.
For agents: follow the briven-auth skill.

What you get

Not a full product UI — a wiring kit:

1. Next-style middleware.ts that forwards /api/auth/* to Briven
   
2. lib/auth.ts using @briven/auth
   
3. Env template for project id + pk_briven_auth_…
   
4. One hosted sign-in button pattern
   

Email + password only is enough for a pilot. Turn on Google/magic link later in the dashboard.

If you enable two-factor: after password sign-in, users may hit the hosted /auth/<projectId>/two-factor step (authenticator code or a backup recovery code). In React apps use TwoFactorChallenge from @briven/auth/react.

For CI/e2e: mint a testing token in the dashboard (or admin API) and call auth.signIn.testToken(process.env.BRIVEN_AUTH_TEST_TOKEN!).

10-minute dogfood path (recommended)

This is the Clerk-gap soft item: a second human can sign up without you pasting code at them.

# 0. Platform awake
#    ./scripts/s6-auth-verify.sh

# 1. Copy this kit outside the monorepo (or use your real app)
cp -r examples/auth-pilot ~/Desktop/auth-pilot-dogfood
cd ~/Desktop/auth-pilot-dogfood

# 2. Wire to cloud (Convex-style)
briven setup --name auth-pilot
#    or: briven connect p_YOUR_EXISTING_PILOT

# 3. Auth files + package
briven auth scaffold
pnpm add @briven/auth

# 4. Dashboard: project → Auth → Enable → API keys → create
#    pk_briven_auth_… only (never put brk_ in the browser)

# 5. Paste into .env.local (do not commit)
#    NEXT_PUBLIC_BRIVEN_PROJECT_ID=p_…
#    NEXT_PUBLIC_BRIVEN_API_ORIGIN=https://api.briven.tech
#    NEXT_PUBLIC_BRIVEN_AUTH_KEY=pk_briven_auth_…
#    BRIVEN_AUTH_PUBLIC_KEY=pk_briven_auth_…

# 6. Run Next, open /sign-in
# 7. YOU: AUTH-GO-LIVE rows 3, 4, 7
# 8. FRIEND: same URL — sign up with their email (soft gap closed)
# 9. Isolation: second project must NOT list either user
#    → ./scripts/auth-isolation-check.sh

Record pass/fail in docs/CLERK-GAP-EVIDENCE.md.

Manual key path (if you already have a key)

briven login --project p_… --key brk_…   # server/cli key only
briven link
briven auth scaffold

Files in this folder

auth-pilot/
├─ briven.json          # name only until setup/link
├─ middleware.ts        # /api/auth/* → api.briven.tech/v1/auth-tenant/*
├─ lib/
│  └─ auth.ts           # createBrivenAuth client
├─ app/
│  └─ sign-in/
│     └─ page.tsx       # hosted sign-in redirect button
└─ README.md

Security

• Only pk_briven_auth_… in the browser.
  
• Never commit a filled .env.local.
  
• Do not paste full keys into chat.

Docs

• https://docs.briven.tech/auth
  
• https://docs.briven.tech/connect
  
• Repo: AUTH-GO-LIVE-CHECKLIST.md, BETA-V1-NEXT-STEPS.md, docs/S6-RELIABILITY.md