Hosted login — the sign-in URL

✅ Verified

Against Axowl.Auth/Services/HostedLoginPortal.cs (URL shape, portal hosts), the portal’s own route (/login/:clientKey), and SignIn.tsx (Callback URL match) — 2026-08-27.

Your app does not implement sign-in. You send people to the Axowl-hosted login page, they come back signed in. This page is the one thing you need to get right.

The URL

{portal}/login/{clientKey}?redirect_url={absolute URL to come back to}

<a href="https://login.axowl.com/login/client_e7bce279e7974411a858?redirect_url=https%3A%2F%2Fexample.com%2F">
  Sign in
</a>

• clientKey — your client’s key, client_…. Dashboard → Application. (The older app_… form is gone; it returns 404.)
• redirect_url — where the person lands after signing in. Absolute, URL-encoded. Omit it and they stay on the login page.

That is the whole contract. There is no ?app= parameter, and axowl.com/login is the Axowl console — your own organization’s sign-in, not your app’s.

redirect_url must be a registered Callback URL

The portal compares it to your Application’s Callback URLs by exact string match, trailing slash included. If it doesn’t match, sign-in stops with Redirect URL "…" is not in this app's Callback URLs. Add it in Application → Authentication → Callback URLs before you ship the button.

The two hosts

Host	Shape	When
https://login.axowl.com	/login/{clientKey}	Default. Works immediately, no setup.
Your own domain, e.g. https://auth.example.com	/ — no key in the path	After you verify a custom login domain. The portal resolves the client from the hostname.

On a custom login domain the button is just:

<a href="https://auth.example.com/?redirect_url=https%3A%2F%2Fexample.com%2F">Sign in</a>

Everything else — providers, branding, the return trip — is identical. Social sign-in stays on the host it started from, so people never see an Axowl address.

Let the SDK build it

If you are on .NET, don’t hand-assemble the string — the SDK owns the shape, so it keeps working when the shape changes:

builder.Services.AddAxowlSdk(o =>
{
    o.HostedLoginUrl = "https://login.axowl.com";   // or your custom login domain
    o.ApiBaseUrl     = "https://testapi.axowl.com";
    o.ApplicationKey = "client_…";
});

// then, wherever the button lives:
@inject IAxowlAuth Auth
var url = Auth.BuildLoginUrl("https://example.com/");   // or Auth.SignIn(...) to go there now

See .NET auth for the full round trip, including how the returned code becomes a verified session.

Checklist

1. Client key is the client_… form.
2. redirect_url is absolute, URL-encoded, and registered as a Callback URL — exact match.
3. Sign-in providers are enabled for the app (Dashboard → Login Methods), or the page shows nothing to click.
4. Using a custom login domain? Verify it first, then drop the key from the path.

Next steps

• Custom login domain — put the page on your own hostname.
• Social login · Passkey · Magic link
• Authentication model — org members vs. your app’s end users.