Automatic sign-in and sign-out
Signing in without a click, signing out of every service, and when account changes reach your app.
Automatic sign-in
Members already signed in to any Society AI service can be recognised in yours without a click:
- On the first visit of a browser session, if the visitor isn't signed in, send them to sign-in with
prompt=none. - If the member is signed in to Society AI, the browser comes back with a
codeand the member is in. - If not, the browser comes back with
error=login_required. Show the page as a guest.
All of it is a short redirect. The Laravel version is step 8 of the Laravel guide.
- Always use a normal page redirect. No hidden iframes: Safari and Chrome block cross-site cookies in iframes.
- Once per browser session, not on every page, and save the flag before redirecting. Otherwise visitors can get stuck in a redirect loop.
- Skip bots and API requests. Search engines keep no cookies, so they neither need nor can take part in the check.
- Public pages stay open to guests. Ask for sign-in only on pages that are truly for members.
Signing out of your service
When a member clicks Keluar in your service, clear your session, then send the browser to /oauth2/sessions/logout with id_token_hint (see the API reference). The member is signed out of society-ai.org and every other service in that browser, then sees "You are signed out".
If you only clear your own session and skip the second step, the member is still signed in to Society AI. The next time they open your service, automatic sign-in brings them right back.
Signing out somewhere else
When a member signs out on society-ai.org or in another service, Society AI calls your back-channel URL so their session in your service is removed too. The full rules are in the API reference.
When account changes reach your app
| What happens | What your app sees | At the latest |
|---|---|---|
| The member signs out in another service | A back-channel logout call | About 1 minute |
| An admin suspends the account | Token renewal is refused with 403 access_denied, and the member can't sign in again | 15 minutes, the lifetime of access and ID tokens already issued |
| Membership status changes (payment, expiry) | New membership claims | When the next token is made: on renewal, or when the member signs in again |
| Name or email changes | New name or email claims | Same as above |
If your service stores membership status in its own database, update it every time you get a new ID token. For important decisions, such as opening paid material, check /userinfo first.