Configuration and authentication#

Public endpoints#

AUTH_BASE_URL=https://auth.starhk.uk
TASK_BASE_URL=https://task.starhk.uk
SITE_ID=<assigned in Star Admin>

Register every production/staging origin and its exact auth callback in Star Admin. The URL scheme, host, and port must match; never add a wildcard callback.

Login#

Send the browser to:

https://auth.starhk.uk/login?site_id=<SITE_ID>&redirect=<ENCODED_CALLBACK_URL>

The callback receives a short-lived authorization code. Exchange it once:

POST https://auth.starhk.uk/auth/exchange
Content-Type: application/json

{"code":"...","site_id":"site-xx"}

Use the returned access token for protected Star Auth and Star Task calls. Implement the existing refresh endpoint/SDK contract so a returning user remains signed in; do not interpret an expired access token as an instruction to discard a still-valid refresh session.

Request rules#

• JSON task creation: put site_id in the body.
• GET/DELETE task calls: pass ?site_id=....
• Uploads may use X-Site-Id.
• A JWT issued for one site cannot be reused for another site.
• Logout clears the local session and invokes the established Star Auth logout flow.

Never ship admin keys, site API keys, provider keys, or RokoAPI credentials to the browser.