Better Auth
Enterprise host (simulated)
This page is a stand-in for an enterprise host on its own origin. Like a real host, it is signed into the identity provider first; only then does it embed the tenant app as a cross-site iframe. Because the two origins differ, the browser treats the framed app as third-party and blocks ordinary cookies — so signing in there has to go through the bridge. This deployment authenticates with Better Auth (the auth-library-agnostic counterpart of the Auth.js demo).
Host sign-in required
Sign in to the host first. This establishes the shared Keycloak SSO session against the same realm/client the tenant app uses — which is what lets the embedded app's bridge popup complete silently, with no second interactive login.