Hosted sign-in across instance domains [Flow]

# Hosted sign-in across instance domains `[Flow]`

Email/mobile stay the sign-in *methods*; the work is making **one gateway session valid on each instance's own hosting domain** (subdomain or custom) — via a **token hand-off**, not a shared cookie. Context: the [platform model](../concepts/platform-model.md).

```mermaid
flowchart TB
    Sign["Director signs in ONCE at meridians.global<br/>(email magic-link/OTP · mobile OTP)"] --> Sess["Supabase session (gateway)"]
    Sess -->|opens their instance| HO["short-lived **one-time token** hand-off"]
    HO --> Sub["&lt;slug&gt;.meridians.global<br/>wildcard cert + one wildcard allowlist entry"]
    HO --> Cust["app.acme.com — custom domain<br/>per-domain Fly cert + allowlist on verify/teardown"]
    Allow["Supabase redirect allowlist =<br/>meridians.global + *.meridians.global + each custom domain"] -.->|spans them all| Sub
    Allow -.-> Cust
```

The hand-off is what keeps the session portable without a shared cookie: sign in once centrally, exchange a one-time token at each instance's own origin.

Raw Markdown source