Bhauu AuthDocumentation
Browse documentation

Integrations

Integration guides

Use the same Authorization Code and PKCE S256 contract across different application architectures.

Browser and SPA

Generate state and PKCE in the browser. Do not embed a client secret or treat browser storage as a long-term vault. A backend-for-frontend is preferable when persistent application sessions are needed.

JavaScriptBrowser primitives and callback.TypeScriptTyped browser transaction.ReactComponent-driven redirect flow.

Server-backed and frameworks

Keep the transaction and any registered secret on the backend. Every guide still uses PKCE; framework choice does not determine client authentication by itself.

Next.jsServer callback architecture.Node.jsBackend token exchange.PHPSession-backed callback.LaravelServer routes and session.PythonStandard-library token exchange.FastAPIBackend callback architecture.