ArchitectureAuthentication

Authentication Architecture

Overview

Lacroo Pro uses Better Auth integrated into the Next.js BFF layer with Microsoft Entra SSO for enterprise single sign-on.

Auth Flow

  1. User initiates login from the web or mobile client
  2. Next.js BFF handles the auth flow via Better Auth
  3. For enterprise users, redirects to Microsoft Entra for SSO
  4. On successful auth, a session is established in the BFF
  5. All subsequent API requests to Go include the auth token in headers
  6. Go API middleware validates the token and injects user context

Every token names what it is for: the web server’s API calls, live updates, file uploads, or the Copilot. The API checks this on every request.

Key Rules

  • Auth sessions live exclusively in the Next.js BFF
  • The Go API never manages sessions — it only validates tokens
  • Mobile clients authenticate via the same Better Auth endpoints
  • All auth state is server-side; no sensitive tokens are stored client-side
OverviewReal-Time & WebSockets