Sign in with YouTeacher: SSO brokering and WooCommerce user provisioning

The store (a WooCommerce site) keeps no login of its own. It is a first-party client of the central YouTeacher account service, and every sign-in resolves back to one YouTeacher identity. That single fact is what lets a purchase made on the store become an entitlement the desktop Authenticator and the web player can later read back: orders tie to the YouTeacher account, not to a store-local password.

The store as a trusted client

Because the store is first-party rather than an anonymous browser, the account service treats it as a trusted client and does not put it through the human-verification step a visitor would face. The store authenticates itself to the account service with a short-lived credential held only in its deployment environment. This is the trust seam: the account service trusts the store, and the store vouches for the end user.

Two ways in

Redirect SSO (preferred). "Sign in with YouTeacher" sends the visitor to the main app to authenticate there, then returns to the store carrying a one-time authorization code. The store trades that code for the YouTeacher identity through the games BFF. The important property is that the store never handles the password — authentication happens on YouTeacher's own surface.

Direct login (fallback). A secondary path lets the store forward credentials to the account service on the user's behalf. Because this path does touch the password in transit, the redirect flow is the default, and the WooCommerce username/password form is hidden on the login page entirely.

Provisioning the local user

Whichever flow authenticated the visitor, the store then finds-or-creates a local WooCommerce user keyed by the YouTeacher email. An existing account with that email is reused; a new one is created as a customer. There is no usable local password, since local password login does not exist. Keying on email — not a store-internal id — is deliberate: it is the same key the entitlements lookup and the "My Games" list use, so it also lines up with guest orders placed under that address.

Silent auto-login

On the account and checkout pages only, a visitor already signed in to YouTeacher but not yet to the store is logged in without a click: the store makes a single silent authorization attempt and completes the same identity handoff. The design's one hazard is a redirect loop when there is no upstream session to find, so a per-browser-session guard ensures the attempt happens at most once per session and the store renders normally if no session turns up. An explicit store logout trips that same guard, so logging out sticks for the session instead of being undone by auto-login. Bots and crawlers are excluded from the whole flow.

Why it's shaped this way

One identity, many surfaces. The store, the desktop Authenticator, and the in-browser player all need to answer "who is this, and what do they own?" Making the store a thin auth client rather than an auth authority keeps the YouTeacher account as the single source of identity; the store's only local job is to mirror that identity into a WooCommerce user, so WooCommerce's own order and entitlement machinery can hang off it.