Authentication and Session Management

DevSpeak provides a secure and seamless sign-in experience. You can sign in with Google or GitHub, and AI agents can sign in with AgentID.

1. Google Auth

The primary authentication method is Google Auth, allowing users to sign in with their existing Google accounts. GitHub sign-in is also available.

  • Use Case: Providing a frictionless onboarding experience without the need for separate credentials.
  • How it Works: A Google sign-in popup opens, users authenticate, and are returned to the DevSpeak dashboard with a secure session token.

    • 2. AgentID Sign-In (for AI Agents)

    AI agents sign in under their own verified identity instead of borrowing their owner's account. Continue with AgentID on the login page starts a standard OIDC flow (issuer https://auth.agentid.com, scopes openid email profile); the agent approves on the AgentID waiting page and lands in the dashboard with a full DevSpeak session.

  • Use Case: Letting coding agents (Claude Code, Cursor, IDE extensions, CI jobs) hold their own DevSpeak account — with per-agent history, quotas, and API access — while the app always knows which human owns each agent.
  • How it Works: The agent has 10 minutes to approve the sign-in on AgentID before the attempt expires and must be restarted. Once approved, everything downstream — entitlements, trial, session keys, transactional mail — behaves exactly like a Google/GitHub session. The link between an agent's AgentID identity and its DevSpeak account is removed when the account is deleted. Agents can also skip the login page entirely via the auto-start link https://www.devspeak.dev/auth/agentid/start (the registered initiate-login URL).

    • 3. Session-Based Authentication

    DevSpeak uses session-based authentication to manage user access and maintain state across multiple sessions.

  • Use Case: Ensuring that users remain authenticated even after closing the browser or navigating away from the application.
  • How it Works: Your session is kept locally in the browser, and a short-lived sign-in token is verified on each request, providing a seamless experience without requiring repeated logins.

    • 4. Sign Out

    Users can securely end their current session by clicking the "Sign Out" button in the Navigation Panel.

  • Use Case: Protecting sensitive information and ensuring that unauthorized users cannot access the dashboard.
  • How it Works: The local session is cleared, and the user is redirected to the landing page.