Go, Python, and other backends

You do not need to read Node.js to integrate — you need the same HTTP behaviour on your origin. Port the four routes and keep kie-la-auth.js unchanged in the browser.

What stays the same in every language

• Origin — set APP_ORIGIN in .env to the public URL registered in the Console (see lib/env.js).
• GET /api/config — return { authOrigin, labStack } (public JSON; no secret).
• GET /api/auth/embed — build the iframe URL: auth server base + path for authUi + embed=1 + parent (see embed-url.js).
• POST /api/session — POST { exchange, parentOrigin } to the auth server /api/exchange; on success set an HttpOnly session cookie on your domain and return { ok, profile }.
• GET /api/me — read your cookie, call the auth server /api/me with the session id; return profile or 401.
• Browser / page stack — copy public/lib/kie-la-auth.js, your HTML mount points, and CSS unchanged in every starter zip (Node, Python, Go, Java, Ruby, Rust).

Server checks are on Test your server (four curl commands and the expected status codes).

Compare with the lab app

nodejs.lab.kie.la is the public reference — same four routes, same browser script. Open DevTools → Network, sign in on the lab, note the order of /api/config, /api/auth/embed, and /api/session, then check your app follows the same pattern on your origin.

Share curl output or a Network capture from your app if you need help — you do not have to use Node.js yourself.

Mount points by authUi

Step 1 on Understand → How it works uses one of these patterns. kie-la-auth.js injects the iframe inside the empty div(s) — you only position the div(s) in your CSS.

<!-- header -->
<header class="site-header">
  …
  <div id="authHeaderRoot" class="header-auth"></div>
</header>

<!-- minimal (two roots) -->
<nav class="site-menu">
  <div id="authMinimalRoot"></div>
</nav>
<div id="authLargeRoot" hidden></div>

<!-- large -->
<div id="authMinimalRoot" hidden></div>
<div id="authLargeRoot" class="login-zone"></div>

CSS reference

Recap of mount-point layout — classes injected by kie-la-auth.js and patterns from the demos.

• Your CSS — position the mount div: e.g. margin-left: auto in a header flex row, display: flex; justify-content: center in a menu strip, or position: fixed; top: … for a sticky band (see the minimal demo menu example).
• Injected by kie-la-auth.js — classes .kie-la-auth-iframe-root, .kie-la-auth-iframe-wrap, .kie-la-auth-iframe; header mode also adds .kie-la-auth-header-root (min size ~4.5×2.25 rem, right-aligned flex).
• Overflow — use overflow: visible on the mount div when the minimal pill expands or the header bar grows, so the iframe is not clipped.
• Hide when signed in — toggle a wrapper with [hidden] or .kie-la-auth-off on the root after onSuccess; the client adds kie-la-auth-off when switching between minimal and large panes.

.header-auth {
  display: flex;
  align-items: center;
  flex-shrink: 0;
  overflow: visible;
}

.demo-menu-example {
  position: fixed;
  top: var(--site-header-h);
  left: 0;
  right: 0;
  display: flex;
  justify-content: center;
  min-height: 4.5rem;
}

Optional: loginIframePlacement in /api/config documents where the large iframe sits on your page (center, top-right, …) for your own layout CSS — the client does not auto-position the large root.