Hi everyone, I would like to use Ory to secure an API and its access: API (backend) <-> Ory (cloud) <-> SPA (frontend). From the documentation, I think I can summarise the workflow as following: 1. From the SPA, an unauthenticated user is redirected to the self-service

<ory_url>/ui/login

(to keep it simple) 2. The authenticated user is then redirected to the callback url pointing to the SPA. 3. The SPA is performing a request on the API (on the same domain). 4. The API must extract the session cookie, and test its validity + retrieve the full information of the session using the

/sessions/whoami

endpoint. 5. Is the session is valid and the user is authenticated, act on the request. Could you confirm my understanding of this workflow?

that sounds right to me and matches how we work with Kratos and an Angular SPA

Yep

Thank you both for your reply @dazzling-napkin-4938 @refined-kangaroo-48640. I'd like to add a second question, which I tried to articulate in #talk-keto: https://ory-community.slack.com/archives/C012RBZFMDG/p1709137169388819