Documentation Index
Fetch the complete documentation index at: https://docs.alterauth.com/llms.txt
Use this file to discover all available pages before exploring further.
Session Tokens
Session tokens are temporary credentials that authorize Alter Connect without exposing API keys.Token Properties
| Property | Description | Default |
|---|---|---|
| Lifetime | How long token is valid | 10 minutes |
| Single use | Can only create one connection | No |
| IP restricted | Locked to user’s IP | Optional |
| Provider list | Which providers to show | All configured (if omitted) |
Creating Secure Sessions
Always create sessions on the backend:Understanding allowed_origin
The allowed_origin parameter controls postMessage security for desktop popup flows:
| Scenario | What to Pass | Example |
|---|---|---|
| Single domain | Omit field (uses website_url from Developer Portal) | Configure in Portal |
| Multiple environments | Pass specific origin | 'https://staging.myapp.com' |
| Local development | Pass localhost | 'http://localhost:3000' |
| Headless / CLI / server-to-server | Omit field | Flow completes; user closes tab manually |
- ✅
https://myapp.com - ✅
http://localhost:3000 - ⚠️
https://myapp.com/(trailing slash auto-removed) - ❌
https://myapp.com/path(no path) - ❌
*(wildcard not supported)
Configuration
| Option | Type | Description |
|---|---|---|
debug | boolean | Enable console logs |
Visual customization (colors, fonts, logo) is configured via the Developer Portal branding settings. The backend-served Connect UI applies the branding automatically. See Branding & Customization below for details.
Open Options
Configure the widget when opening:Connections Array
onSuccess receives an array of Connection objects (multi-provider flow). Users can connect multiple providers in a single session.
Error Handling
Handle errors gracefully:Browser Support
| Browser | Minimum Version |
|---|---|
| Chrome/Edge | 90+ |
| Firefox | 88+ |
| Safari | 14+ |
| iOS Safari | 14+ |
| Chrome Mobile | Latest |
Content Security Policy
If the application uses a Content Security Policy, the Alter Connect domain must be allowed. Check the Developer Portal for the exact domain to add to theframe-src and connect-src directives.
TypeScript
Full TypeScript support included:Methods
AlterConnect.create(config?)
Create an instance with optional configuration.
alterConnect.open(options)
Open the OAuth connection flow. Returns a Promise.
alterConnect.close()
Programmatically close the widget.
alterConnect.destroy()
Clean up and remove event listeners.
Events
Listen to SDK events:Branding & Customization
Customize the Alter Connect UI to match the application’s look and feel. Branding is configured in the Developer Portal and applied automatically when users open the Connect flow.What You Can Customize
| Property | Description | Requirements |
|---|---|---|
| Logo | The application logo displayed in the Connect UI | HTTPS URL, max 500 characters |
| Primary color | Buttons and interactive elements | Hex format (#RRGGBB) |
| Text color | Text and labels | Hex format (#RRGGBB) |
| Background color | Page background | Hex format (#RRGGBB) |
| Font family | Typography throughout the UI | Any CSS font-family value (optional) |
Setting Up Branding
Open the Developer Portal
Go to portal.alterauth.com and select the application
Configure the brand
- Upload or link to a logo (HTTPS URLs only)
- Set the brand colors (primary, text, background)
- Optionally set a custom font family
How It Works
When a user opens Alter Connect, the UI automatically renders with the configured branding:- The logo appears at the top of the provider selection and authorization screens
- The primary color is used for buttons, links, and interactive elements
- The text and background colors ensure readable contrast
- The font family (if set) applies to all text in the UI
Resetting to Defaults
Delete the branding configuration in the Developer Portal to revert to the default Alter Connect appearance.Troubleshooting
Widget Not Opening
- Verify session token is valid (not expired)
- Check browser console for errors
- Ensure popup blockers are disabled
Connection Fails
- Verify OAuth app credentials in Developer Portal
- Check redirect URI matches exactly
- Ensure scopes are configured correctly
Tokens Not Working
- Confirm the
grant_idis correct and belongs to the application - Verify connection was completed successfully
- Check token hasn’t expired (auto-refresh should handle this)
Security Best Practices
- Never expose API keys - Always create sessions server-side
- Use short-lived tokens - 10 minutes or less
- Implement IP restrictions - Lock sessions to user’s IP
- Validate on backend - Always verify the connection on the server
- Use HTTPS - Never use in production without HTTPS