Connect your app to Dots.

npm install @wrldbld/dots@0.1.0-alpha.0

// Run in browser code. Register redirectUri before sign-in.
import { createDots } from "@wrldbld/dots";

const issuer = "https://www.dots.id";
export const dots = createDots({
  issuer,
  apiKey: "YOUR_PUBLIC_CLIENT_ID", // legacy SDK name for the public client_id
  redirectUri: "https://your-app.example/dots/callback",
  scopes: ["openid","profile"],
  storage: window.sessionStorage,
  transactionStorage: window.sessionStorage,
});

// Bind this to the sign-in button.
export async function signIn() {
  await dots.signIn();
}

// Call once on the callback page and display any error.
export async function finishSignIn() {
  await dots.handleCallback(window.location.href);
  const accessToken = await dots.getAccessToken();
  if (!accessToken) throw new Error("Sign in again");
  const response = await fetch(issuer + "/api/oauth/userinfo", {
    headers: { Authorization: "Bearer " + accessToken },
  });
  if (!response.ok) throw new Error("Dots userinfo failed: " + response.status);
  const userinfo = await response.json();
  // Account key: (issuer, userinfo.sub).
  // A backend must verify identity itself; never trust a browser-supplied sub.
  return userinfo;
}

export async function signOut() {
  await dots.signOut();
}

The browser example shows separate sign-in, callback, and sign-out handlers. Run the callback once, handle failures, and initialize only in browser code. sessionStorage is accessible to JavaScript; use a server session with HttpOnly cookies when your app has a backend.