The TanStack template keeps auth tokens out of browser-managed storage. Browser state may cache a safe user summary, but the backend session token belongs in the HttpOnly tenant cookie.
Supported entry points
/loginand/auth/login/auth/register/auth/verifyand/auth/verify-email/auth/forgot-passwordand/auth/reset-password/auth/callbackfor GitHub OAuth- guest login and
/auth/guest-convert
Cookie-setting handlers
Handlers that can receive a token from the backend should pass through authCookieJsonResponse. That removes token fields from the JSON response and sets the tenant cookie.
Account surface
/dashboard/profile (legacy /profile redirects here) reads the current session through /api/auth/check, supports profile updates, password changes, guest conversion prompts, and account-deletion request flow through support tickets.