Centralized Authentication Architecture
Understand how Lexino AI manages identity across subdomains using Clerk and native .lexinoai.in session cookies.
Lexino AI powers identity via Clerk with a custom 3D cyberpunk interface, providing enterprise-grade security and seamless cross-subdomain single sign-on.
#Unified Authentication & Session Scope
Rather than duplicating authentication logic across multiple domains, Lexino AI provides a single unified login portal at /login.
• When an unauthenticated visitor requests a protected workspace surface (e.g. chat.lexinoai.in), the edge middleware seamlessly redirects them to www.lexinoai.in/login with a redirect_url parameter.
• Upon successful login via Google SSO or email, Clerk writes the session token (__session) scoped to .lexinoai.in.
• The user is then returned to the exact page they requested with their session already active.
#Session Security & Token Scope
• Apex Scoping: Session cookies are set with Domain=.lexinoai.in, Secure, HttpOnly, and SameSite=Lax.
• Zero Secret Exposure: Client browsers never receive backend API keys or database connection strings.
• Cross-Site Protection: Strict Content Security Policy (CSP) and Cross-Origin-Opener-Policy headers prevent clickjacking and session spoofing.