Demo and Quick Start

Try the hosted ChatLogin demo or template playground. These use public synthetic identities, not real business data.

chatlogin serve runs the product demo entirely from the installed ChatLogin wheel; it does not depend on source-relative files. Use it to choose an authentication backend, frontend integration level, and LoginUI configuration. It is not a shared production identity service.

Install and Run

python -m pip install "ChatLogin[demo]"
chatlogin serve

The default address is http://127.0.0.1:8765/. The demo extra includes FastAPI, Starlette, Jinja2, and Uvicorn; the core package still does not force these web dependencies.

Usage: chatlogin serve [OPTIONS]

Options:
  --host TEXT           Bind address; loopback by default.  [default: 127.0.0.1]
  --port INTEGER RANGE  TCP port.  [default: 8765; 1<=x<=65535]
  --origin TEXT         Fixed trusted public origin for browser Host/Origin checks.
  --help                Show this message and exit.

When a reverse proxy terminates TLS, keep the process on loopback and explicitly provide the origin browsers use:

chatlogin serve \
  --host 127.0.0.1 \
  --port 8765 \
  --origin https://login.example.com

--origin is fixed security configuration. It is never inferred from Host, X-Forwarded-Host, or X-Forwarded-Proto. Proxy policy, TLS, process supervision, and public rate limiting remain deployment responsibilities.

What You Can Exercise

The public demo identity is demo / chatlogin-demo. It has no business permission and maps to no real account or customer data. Fill Demo only inserts these public synthetic values.

Backend	Frontend	Entry	Data source
PasswordBackend	Default LoginUI	/demo/password/	One explicit synthetic hash built at process startup
CallbackBackend	Host renderer override	/demo/callback/	Local synchronous synthetic callback
AsyncCallbackBackend	ui=None + host HTML/JS	/experience/async	Local asynchronous synthetic callback
ChatVoiceAuth	Split/dark LoginUI	/demo/chatvoice/	Disposable shared-memory SQLite legacy-schema fixture

Each mode has a separate cookie name and session namespace. The post-login workspace renders only a safe Principal and backend/UI labels, with real protected-read, successful/failed CSRF, and logout actions. Pages and logs do not render session tokens, cookies, password hashes, or CSRF values. CSRF is returned only in same-origin session/login JSON for safe writes; session tokens are delivered through HttpOnly cookies.

The template playground at /templates is generated by real LoginUI.render(). It accepts only three palettes, two layouts, light/dark/system, and a guest toggle, then produces exact copyable Python configuration. It accepts no arbitrary HTML or filesystem path.

Health and version readback:

GET /health   -> {"status":"ok","version":"0.1.5"}
GET /version  -> {"version":"0.1.5"}

Demo Security Boundary

• Each backend permits at most 16 live sessions with a five-minute TTL. Capacity exhaustion returns retryable HTTP 503 without evicting another live session.
• Memory modes live only in the current process. The ChatVoice fixture exists only for the shared-memory SQLite lifetime and writes nothing to a user home.
• Auth/private responses are no-store; cookies are HttpOnly, fixed-path, SameSite=Strict, and Secure for an HTTPS origin.
• Every browser POST uses a fixed same-origin check. Repeat login with an existing cookie bootstraps session state and sends current CSRF before rotating.
• Allowlisted assets are loaded from package resources with correct content types; CSP requires no external CDN.
• The demo reads no ChatEnv profile, production provider, real account database, or arbitrary forwarded header.

Integrate a Real Project

Production hosts install ChatLogin[web] and choose their own CredentialBackend, SessionStore, fixed origin, and business authorization. Default UI, host override, and headless are independent frontend choices—not OAuth/SMS authentication protocols.

• Integration and Security: runnable FastAPI setup, template override, headless sequence, callbacks, ChatVoice schema, and stores.
• Capability Map: implemented and explicitly excluded behavior.
• Python Interface Tree: actual constructor signatures and HTTP routes.

ChatLogin provides no default production password, OAuth, SSO, MFA, email/SMS code, QR login, account console, or cross-product identity center.