Hosted pages

Every project with auth enabled gets complete sign-in and sign-up pages at:

https://<your-domain>/_ploy/auth/sign-in
https://<your-domain>/_ploy/auth/sign-up

They work with any framework, including static sites, because they need no package and no JavaScript in your app. They run on your own domain, so there is no redirect to a third-party login domain and the session cookie is set directly for your app.

Use them

Link to the page with the path to return to after sign-in:

<a href="/_ploy/auth/sign-in?redirectTo=/dashboard">Sign in</a>

After a successful sign-in or sign-up the user lands on redirectTo with a ploy_session cookie. Users who are already signed in are sent straight to redirectTo.

redirectTo accepts a path or a URL on your app's origin. Anything else falls back to /, so the pages can't be used as an open redirect.

To sign out, POST to /_ploy/auth/signout.

What they show

The pages follow your project's sign-in methods: Google, Apple, and GitHub buttons, passkeys, and the email and password form, each only when enabled. Require name adds a name field to sign-up, and when sign-ups are off the sign-up page says so.

The heading shows your project name. Pages follow the visitor's light or dark system preference.

If a social sign-in fails, the user returns to the page with the reason shown, for example when they cancel at the provider.

Security

• Every page is self-contained: no external scripts, styles, or fonts.
• A strict Content Security Policy with a per-request nonce blocks injected scripts, and frame-ancestors 'none' prevents clickjacking.
• Responses are no-store, so sign-in pages are never cached by a CDN.

With Next.js

protect() and authMiddleware from @meetploy/nextjs redirect signed-out users to the hosted sign-in page by default.

Local development

ploy dev serves the same pages from the local emulator. With Next.js and initPloyForDev(), the helpers point at the emulator automatically.