Authenticate a user through WorkOS AuthKit hosted sign-in: build the authorization URL, handle the callback, and exchange the code for a sealed session cookie

Documented steps

1. Register the exact redirect_uri in the WorkOS Dashboard first — an unregistered Redirect URI causes the authorize request to error out.
2. Build the authorization URL: GET https://api.workos.com/user_management/authorize with required query params client_id, redirect_uri, response_type=code. Optional: provider (e.g. 'authkit'), organization_id, screen_hint ('sign-up'|'sign-in'), login_hint, domain_hint, state, and code_challenge + code_challenge_method=S256 for PKCE.
3. Redirect the browser to that URL; the user completes sign-in or sign-up on the AuthKit hosted UI.
4. WorkOS redirects back to your redirect_uri with a `code` query param (plus your `state` if set) — implement a callback route to receive it.
5. Exchange the code: POST https://api.workos.com/user_management/authenticate with client_id, grant_type='authorization_code', code, and client_secret (or code_verifier if using PKCE instead of a client secret).
6. In an SDK, call authenticateWithCode({ clientId, code, session: { sealSession: true, cookiePassword } }) — this exchanges the code and seals the session in one call.
7. Read the response: user, organization_id (if applicable), access_token (JWT), refresh_token, authentication_method; with sealSession it also returns a sealedSession string.
8. Store the sealed session as an httpOnly cookie (conventionally 'wos-session'). The cookiePassword must be 32 characters — generate with `openssl rand -base64 32` and keep it in env (e.g. WORKOS_COOKIE_PASSWORD).
9. Optional authenticate params worth passing: invitation_token (accept a pending invitation during sign-up), ip_address, user_agent, device_id.
10. Handle pending-authentication responses instead of tokens: organization_selection_required, sso_required, email_verification_required, mfa_enrollment, mfa_challenge — each returns a pending_authentication_token you must carry into the follow-up call.
11. Reference: https://workos.com/docs/reference/authkit/authentication/get-authorization-url
12. Reference: https://workos.com/docs/reference/authkit/authentication