> ## Documentation Index
> Fetch the complete documentation index at: https://docs.streamly.watch/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication Flow

> How Streamly authenticates operators and viewers — Envato activation, Resend magic-link, verify-email, and separate cookie scopes.

Streamly uses **Supabase Auth** with two isolated cookie jars so the operator console and viewer storefront never share a session by accident.

## Cookie scopes

| Audience | Cookie name                       | Sign-in             |
| -------- | --------------------------------- | ------------------- |
| Viewer   | `sb-streamly-viewer-auth-token`   | `/login`, `/signup` |
| Operator | `sb-streamly-operator-auth-token` | `/admin/login`      |

Implemented in `lib/supabase/auth-scope.ts`.

## Operator flow (production)

1. Open `/admin/login`.
2. Enter your Envato/CodeCanyon **purchase code** (verified with `ENVATO_PERSONAL_TOKEN` in production). Optional: restrict to one item with `ENVATO_ITEM_ID`.
3. Streamly sends a **magic-link email** via Resend (`RESEND_API_KEY` + `STREAMLY_FROM_EMAIL`).
4. If the account is unverified, the operator is sent to **`/verify-email`** until verification completes.
5. After success → `/admin/overview` (or `/admin/onboarding` when required).

<Warning>
  On real installs, **Resend is required for operator sign-in** (unless you intentionally enable the demo license gate). Treat `RESEND_API_KEY` as a launch blocker, not optional polish.
</Warning>

### Demo license (sandbox only)

When `ENABLE_DEMO=true` or `ADMIN_ALLOW_DEMO_LICENSE` is set:

| Field         | Value                                                      |
| ------------- | ---------------------------------------------------------- |
| Purchase code | `demo`                                                     |
| Email prefill | `admin@streamly.watch`                                     |
| UI            | “Try demo license” — instant Connect without Envato verify |

**Turn demo flags off** on production buyer installs.

## Viewer flow

1. Viewer opens `/login` or `/signup`.
2. Supabase issues a session stored in the **viewer** cookie jar.
3. `/auth/callback` completes OAuth / magic-link style redirects when used.
4. Middleware may require a Who’s Watching profile (`/profiles`) before gated routes.
5. `/movies` and `/shows` require authentication.

Optional demo viewer (auto-created when configured): `demo@streamly.watch` / `demo123456` — **not** the operator account.

## Refresh

`/api/auth/refresh` renews sessions. Middleware stays intentionally small for Cloudflare Worker size limits.

Landing helpers: `/api/landing/session`, `/api/landing/logout`.

## Related

* [Profiles](/authentication/profiles)
* [Session Management](/authentication/session-management)
* [Roles & Permissions](/authentication/roles-permissions)
* [Supabase](/configuration/supabase)