---
title: "Bring Your Own Auth — AVCodex Docs"
description: "Bring Your Own Auth — AVCodex documentation for AV integrators, programmers, and ops teams."
lang: en
json-ld:
---

[](/)

Solutions

[Pricing](/pricing)[The Signal](/blog)[Resources](/resources)

Learn

[Free AI Assessment](/scorecard)[Get Started →](/pricing)

[Documentation Home](/docs)

Guides 

Getting Started

-   [The Alchemist Copilot](/docs/guides/the-alchemist-copilot)
-   [Choosing a Model](/docs/guides/choosing-a-model)
-   [Skills & Templates](/docs/guides/skills-and-templates)
-   [Pricing & Usage](/docs/guides/pricing-and-usage)
-   [Understanding Tokens](/docs/guides/understanding-tokens)
-   [Maximize AVCodex Capabilities](/docs/guides/maximize-avcodex-capabilities)

Knowledge & Memory

-   [How Knowledge Sources Work](/docs/guides/how-knowledge-sources-work)
-   [Knowledge Retrieval Settings](/docs/guides/knowledge-retrieval-settings)
-   [User Memory](/docs/guides/user-memory)
-   [Consumer Brain](/docs/guides/consumer-brain)

Agent Capabilities

-   [Image Recognition](/docs/guides/image-recognition)
-   [Image Generation](/docs/guides/image-generation)
-   [Video Generation](/docs/guides/video-generation)
-   [Deep Research and Deep Thinking](/docs/guides/deep-research-and-deep-thinking)
-   [Heartbeat (Proactive AI Outreach)](/docs/guides/heartbeat-proactive-ai-outreach)
-   [Database Connections](/docs/guides/database-connections)
-   [Agent-to-Agent Links](/docs/guides/agent-to-agent-links)
-   [Message Tagging](/docs/guides/message-tagging)
-   [Lead Generation Forms](/docs/guides/lead-generation-forms)
-   [Multilingual Apps](/docs/guides/multilingual-apps)
-   [Understanding Evaluations](/docs/guides/understanding-evaluations)

Design & Experience

-   [Style Studio](/docs/guides/style-studio)
-   [Component Studio](/docs/guides/component-studio)
-   [HQ Profile](/docs/guides/hq-profile)
-   [Multiplayer Chat](/docs/guides/multiplayer-chat)
-   [Circles](/docs/guides/circles)
-   [Desktop Agent](/docs/guides/desktop-agent)

Voice & Phone

-   [Phone Numbers](/docs/guides/phone-numbers)
-   [Outbound Calling](/docs/guides/outbound-calling)
-   [Voice Cloning](/docs/guides/voice-cloning)

Publish & Share

-   [Embed Chat Widget](/docs/guides/embed-chat-widget)
-   [Custom Domains](/docs/guides/custom-domains)
-   [PWA Installation](/docs/guides/pwa-installation)
-   [AVCodex Sites](/docs/guides/avcodex-sites)
-   [Embed on Kajabi](/docs/guides/embed-on-kajabi)
-   [How to Use AVCodex with Claude Code](/docs/guides/how-to-use-avcodex-with-claude-code)

Monetization & Access

-   [Selling Access](/docs/guides/selling-access)
-   [Consumer Monetization](/docs/guides/consumer-monetization)
-   [Access Control](/docs/guides/access-control)
-   [Bring Your Own Auth](/docs/guides/bring-your-own-auth)
-   [Clever SSO for Schools](/docs/guides/clever-sso-for-schools)

Analytics & Operations

-   [Analytics & Chat History](/docs/guides/analytics-and-chat-history)
-   [Performance Dashboard](/docs/guides/performance-dashboard)
-   [Programmatic Usage Stats](/docs/guides/programmatic-usage-stats)
-   [Session Lifecycle Webhooks](/docs/guides/session-lifecycle-webhooks)
-   [Audit Logs](/docs/guides/audit-logs)

Teams & White-Label

-   [Team Management](/docs/guides/team-management)
-   [Enterprise Whitelabel](/docs/guides/enterprise-whitelabel)

Alchemist Platform

-   [Alchemist Tickets](/docs/guides/alchemist-tickets)
-   [Alchemist Getting Started](/docs/guides/alchemist-getting-started)
-   [Alchemist Working with Tickets](/docs/guides/alchemist-working-with-tickets)
-   [Alchemist Local Development](/docs/guides/alchemist-local-development)

Alchemist Operations

-   [Alchemist Environment Variables](/docs/guides/alchemist-environment-variables)
-   [Alchemist Deploys and Domains](/docs/guides/alchemist-deploys-and-domains)
-   [Alchemist Self-Healing](/docs/guides/alchemist-self-healing)

Alchemist API & Automation

-   [Alchemist API Keys](/docs/guides/alchemist-api-keys)
-   [Alchemist MCP Server](/docs/guides/alchemist-mcp-server)
-   [Alchemist Pipeline Configuration](/docs/guides/alchemist-pipeline-configuration)
-   [Alchemist Pipeline Permutations](/docs/guides/alchemist-pipeline-permutations)

Developer Platform

-   [Building Custom MCP Servers](/docs/guides/building-custom-mcp-servers)
-   [Consumer OAuth for Custom MCP Servers](/docs/guides/consumer-oauth-for-custom-mcp-servers)

AVCodex MCP Server

-   [Overview](/docs/guides/overview)
-   [MCP Reference](/docs/guides/mcp-reference)
-   [Setup & Installation](/docs/guides/setup-and-installation)
-   [Authentication](/docs/guides/authentication)
-   [Tools Reference](/docs/guides/tools-reference)
-   [Common Workflows](/docs/guides/common-workflows)
-   [Rate Limits](/docs/guides/rate-limits)

Custom Actions 

Pro Actions 

API 

Builder API 

Agentic Commerce (ACP) 

Integrations 

[Docs](/docs)/ Guides / Monetization & Access 

# Bring Your Own Auth

Last updated · MAR 2026 · [Read as Markdown](/docs/guides/bring-your-own-auth.md)

# Bring Your Own Auth (Pre-Authenticated Sessions)

Sign users into your AVCodex app from your own backend, with server-side identity that works across devices and inside iframe embeds.

* * *

If your application already authenticates its users (Entra ID, Okta, Auth0, WorkOS, Clerk, a custom SSO, or your own signed links), you do not need to make them sign in again inside AVCodex. Your backend can mint an AVCodex session for a user it has already verified, and the chat opens pre-authenticated: no login screen, no OTP, no second password.

This is the recommended pattern for white-label deployments, portals behind your own login, and governed workflows.

> **Note:** Because the consumer identity created this way lives on AVCodex servers, keyed by email, it is portable across devices. Any device where your backend mints a token for the same email is the same consumer, with the same conversation history.

## [How it works# ](#how-it-works)

code 

```
User opens your app or your protected link
    1. Your backend verifies the user (your auth, your signature checks)
    2. Your backend calls POST /api/v1/apps/{appId}/consumers/auth
       -> AVCodex finds or creates the consumer and returns a bearer token
    3. Your page passes the token to the embedded chat
       -> the user is signed in, no AVCodex login screen
```

AVCodex never sees or validates your credentials or signed links. Your backend is the authority: it decides who gets a token, and AVCodex trusts the Builder API call because it carries your secret API key.

## [Step 1: Mint a token on your server# ](#step-1-mint-a-token-on-your-server)

Call the Builder API endpoint `POST /api/v1/apps/{appId}/consumers/auth` from your backend. It requires a Builder API key with `consumers:write` scope.

bash 

```
curl -X POST https://app.avcodex.com/api/v1/apps/YOUR_APP_ID/consumers/auth \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "jane@integrator.com",
    "name": "Jane Doe",
    "metadata": { "accountTier": "enterprise", "siteId": "BLDG-4821" }
  }'
```

Response:

json 

```
{
  "data": {
    "token": "eyJhbGciOi...",
    "consumer": { "id": "...", "email": "jane@integrator.com", "name": "Jane Doe" },
    "expires_at": "2026-08-16T10:00:00Z"
  }
}
```

## [Step 2: Pass the token to the chat# ](#step-2-pass-the-token-to-the-chat)

Hand the returned token to the embedded chat on page load. The consumer is signed in immediately, with their history intact.

## [Security notes# ](#security-notes)

-   **Mint tokens server-side only.** The Builder API key must never reach the browser. If it does, anyone can mint a session for any email.
-   **Verify before you mint.** AVCodex trusts your API call completely. Whatever email you pass becomes the authenticated identity. Check your own session first.
-   **Tokens expire.** Mint fresh on each page load rather than caching long-lived tokens client-side.

## [Why this matters for AV deployments# ](#why-this-matters-for-av-deployments)

Most enterprise AV clients will not accept a second login for a room-support tool. If the user is already signed into the corporate intranet or the facilities portal, the support agent has to inherit that session or adoption dies at the login screen.

This is also how you attach room and site context without asking the user. Pass `siteId`, `buildingId`, or `roomId` in `metadata` at token mint time, and the agent knows where the user is before the first message.

\*AVCodex · Your AV expertise. Amplified by AI.\*

Was this helpful? 

[Edit this page →](#)

[

Previous

Access Control

](/docs/guides/access-control)[

Next

Clever SSO for Schools

](/docs/guides/clever-sso-for-schools)

On this page

-   [How it works](#how-it-works)
-   [Step 1: Mint a token on your server](#step-1-mint-a-token-on-your-server)
-   [Step 2: Pass the token to the chat](#step-2-pass-the-token-to-the-chat)
-   [Security notes](#security-notes)
-   [Why this matters for AV deployments](#why-this-matters-for-av-deployments)

[](/)

The AI platform built exclusively for professional AV. Build, deploy, and sell AI tools that understand your industry.

### Platform

-   What You Can Build
-   Templates
-   [Pricing](/pricing)

### Services

-   [Done-For-You](/pricing)
-   [Academy](/academy)
-   [Contact](/contact)

### Company

-   About
-   [The Signal](/blog)
-   [Docs](/docs)
-   [LinkedIn](#)

© 2026 AVCodex. A Future Ready Holdings Inc. product. SOC 2 Type II Certified · HIPAA Compliant