Connect your app to Dots.

npm install @wrldbld/dots-core@0.2.0-alpha.0

// Browser code only. Register once, then save this client ID in app config.
import { createDotsClient, createWebStorage } from "@wrldbld/dots-core";

const issuer = "https://www.dots.id";
const clientId = "YOUR_PUBLIC_CLIENT_ID";
const redirectUri = "https://your-app.example/dots/callback";
export const dots = createDotsClient({
  issuer, clientId,
  storage: createWebStorage(window.sessionStorage, "dots:" + clientId + ":session"),
  transactionStorage: createWebStorage(window.sessionStorage, "dots:" + clientId + ":pkce"),
});

// On normal app pages, restore before using protected features.
export async function restoreSignIn() {
  await dots.session.restore();
  return dots.session.current()?.identity ?? null;
}

// Bind to the sign-in button. Display errors from each handler in your UI.
export async function signIn() {
  window.location.assign(await dots.authorize(redirectUri, "openid profile", ["api"]));
}

// Call once on the callback page; cache this promise across React effect replays.
let callbackPromise: Promise<unknown> | undefined;
export function finishSignIn() {
  return callbackPromise ??= (async () => {
    await dots.handleCallback(window.location.href);
    window.history.replaceState(null, "", "/");
    // UserInfo-verified identity. Account key: (identity.issuer, identity.sub).
    // Use dots.whoami() for the permitted bootstrap/context snapshot.
    // A backend must verify identity before creating its own app session.
    return dots.session.current()!.identity;
  })();
}

export async function signOut() {
  await dots.logout();
}

The browser example shows separate sign-in, callback, and sign-out handlers. Run the callback once, handle failures, and initialize only in browser code. sessionStorage is accessible to JavaScript; use a server session with HttpOnly cookies when your app has a backend.