@authowl/react 0.15.0 → 0.17.0

package/README.md

@@ -1,5 +1,9 @@
 # @authowl/react
 
+**[Complete SDK guide](https://authowl.dev/docs/sdks/react)** ·
+**[React quickstart](https://authowl.dev/docs/getting-started/quickstart-react)** ·
+**[Error handling](https://authowl.dev/docs/sdks/errors)**
+
 React provider, hooks, and drop-in components for [AuthOwl](https://authowl.dev),
 the multi-tenant auth service. Publishable-key based, zero CSS setup.
 
@@ -51,10 +55,27 @@ link or code email verification, passkey registration, email changes, account
 deletion, and TOTP backup-code availability. Existing credentials remain
 manageable even when creating another credential of that type is disabled.
 
+Built-in controls use AuthOwl gold (`#F5B84C`) by default. A project color set
+in the dashboard replaces it automatically, and an explicit provider override
+wins over the project setting:
+
+```tsx
+<AuthOwlProvider appearance={{ primaryColor: '#0EA5A4' }} {...config} />
+```
+
 When phone OTP is enabled, `<SignIn />` adds the localized phone flow automatically.
 `<PhoneOTP />` is also available as a standalone surface. Production hosts must allow
 Cloudflare Turnstile's challenge script in their Content Security Policy. Local and CI
 servers use AuthOwl's documented dummy-token path when no public site key is configured.
+When the server selects an Akedly Shield V1.2 route, these components fetch a fresh
+challenge and complete its proof-of-work and optional Turnstile ceremony automatically.
+Provider API keys and pipeline credentials remain server-side. Custom phone UIs can call
+`phoneOtp.prepare()` and `solvePhoneOtpChallenge()` to implement the same guarded flow.
+See the [complete headless and retry guide](https://github.com/mstfash/authowl-sdk/blob/main/docs/phone-otp.md).
+
+`@akedly/shield` is installed with `@authowl/core` so every consumer bundler can
+resolve the integration safely. It remains behind a dynamic import, so its
+browser proof code is loaded only when the server selects a Shield route.
 
 When broad auth protection is enabled, the sign-in, sign-up, magic-link, email
 OTP, password-reset, and verification components automatically run an
@@ -72,7 +93,8 @@ safe to embed in client code. Durable session tokens live only in `HttpOnly` +
 `Secure` + `SameSite=None` cookies. `useSession()` and `<UserProfile />` use
 token-free session ids and safe device metadata.
 
-See the full integration guide in the AuthOwl app repo (`INTEGRATION.md`).
+See the [complete React guide](https://authowl.dev/docs/sdks/react) for provider
+configuration, hooks, component contracts, localization, theming, and errors.
 
 ## License