# Configuration and authentication

## Public endpoints

```text
AUTH_BASE_URL=https://auth.starhk.uk
TASK_BASE_URL=https://task.starhk.uk
SITE_ID=<assigned in Star Admin>
```

Register every production/staging origin and its exact auth callback in Star Admin. The URL scheme, host, and port must match; never add a wildcard callback.

## Login

Send the browser to:

```text
https://auth.starhk.uk/login?site_id=<SITE_ID>&redirect=<ENCODED_CALLBACK_URL>
```

The callback receives a short-lived authorization `code`. Exchange it once:

```http
POST https://auth.starhk.uk/auth/exchange
Content-Type: application/json

{"code":"...","site_id":"site-xx"}
```

Use the returned access token for protected Star Auth and Star Task calls. Implement the existing refresh endpoint/SDK contract so a returning user remains signed in; do not interpret an expired access token as an instruction to discard a still-valid refresh session.

## Request rules

- JSON task creation: put `site_id` in the body.
- GET/DELETE task calls: pass `?site_id=...`.
- Uploads may use `X-Site-Id`.
- A JWT issued for one site cannot be reused for another site.
- Logout clears the local session and invokes the established Star Auth logout flow.

Never ship admin keys, site API keys, provider keys, or RokoAPI credentials to the browser.