Auth not configured

Sign-in is visible. Production auth is still gated.

The public sign-in path is present, but provider sign-in is blocked until the required WorkOS environment is configured.

WorkOS

auth provider proof

AuthKit is the current proof path for hosted password, one-time-code, Google, and Microsoft sign-in.

0

tenant access by login

Authentication alone does not grant school membership, role permissions, or tenant data access.

Later

school finder routing

Custom domains, school subdomains, organization discovery, and invitation routing remain production gates.

Safe

secret handling

The status page lists missing environment variable names but does not print secret values.

Missing configuration

Add the missing local environment variables, then restart the dev server. Only variable names are shown here; secret values are not printed or stored in the client.

  • WORKOS_API_KEY is missing
  • WORKOS_CLIENT_ID is missing
  • WORKOS_COOKIE_PASSWORD is missing
  • AUTH_SESSION_HASH_KEY is missing
  • NEXT_PUBLIC_WORKOS_REDIRECT_URI is missing

What remains before live school access

Provider configuration

WorkOS environment values, callback URL, logout URL, and secure cookie/hash keys must be configured before provider sign-in can start.

External providers

Google Workspace and Microsoft Entra sign-in require provider apps and WorkOS dashboard setup before production use.

Tenant membership

A verified identity still needs a school membership, role, scope, and withTenant/RLS context before workspaces unlock.

MFA and step-up

Staff-required MFA, student-optional MFA, and high-risk step-up actions remain server-enforced production gates.

Auth readinessSecurity proofDemo loginPublic site

Production sign-in and school finder not connected

  • No production WorkOS app is created by this page.
  • No Google or Microsoft OAuth app is created by this page.
  • No MFA enrollment or step-up challenge is launched by this page.
  • No invitation is sent and no tenant membership is created.
  • No school finder, tenant discovery, custom-domain routing, or subdomain routing is live.
  • No support grant, role assignment, or signed-in workspace access is created by this page.
  • No live school data is read or shown by this page.