@dotbots-boutique/auth-sdk 1.0.5 → 1.0.7

package/README.md

@@ -115,7 +115,7 @@ App (frontend) → Local proxy (per server) → api.dotbots.ai
 
 During `initialize()`, the SDK fetches the proxy config from `GET {apiUrl}/api/proxy/config`. After that, all `auth.fetch()` calls are routed through the proxy automatically. If the proxy config cannot be fetched, the SDK falls back to direct communication with `apiUrl`.
 
-Auth endpoints (`/api/auth/*`) and the proxy config endpoint always go directly to `apiUrl` — never through the proxy.
+Auth endpoints (`/auth/*`) and the proxy config endpoint always go directly to `apiUrl` — never through the proxy.
 
 ---
 

package/dist/cjs/index.js

@@ -10,7 +10,7 @@ class DotBotsAuthError extends Error {
 }
 
 class TokenManager {
-    constructor(config, environment, onRefreshed, onSessionExpired) {
+    constructor(config, environment, onRefreshed, onSessionExpired, getBaseUrl) {
         this.accessToken = null;
         this.refreshToken = null;
         this.expiresAt = 0;
@@ -19,6 +19,7 @@ class TokenManager {
         this.environment = environment;
         this.onRefreshed = onRefreshed;
         this.onSessionExpired = onSessionExpired;
+        this.getBaseUrl = getBaseUrl;
     }
     setTokens(tokens) {
         this.accessToken = tokens.accessToken;
@@ -33,7 +34,12 @@ class TokenManager {
         return this.accessToken !== null && Date.now() < this.expiresAt;
     }
     async exchangeCode(code) {
-        const response = await this.apiRequest('/api/auth/token', {
+        if (!code) {
+            console.error('[DotBotsAuth] exchangeCode called without a code — aborting token exchange');
+            throw new DotBotsAuthError('CODE_EXPIRED', 'No auth code provided');
+        }
+        console.warn(`[DotBotsAuth] Exchanging auth code: ${code.substring(0, 2)}**`);
+        const response = await this.apiRequest('/auth/token', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ code, appId: this.config.appId }),
@@ -53,7 +59,7 @@ class TokenManager {
         }
         let response;
         try {
-            response = await this.apiRequest('/api/auth/refresh', {
+            response = await this.apiRequest('/auth/refresh', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({
@@ -74,7 +80,7 @@ class TokenManager {
     async revoke() {
         if (this.accessToken && this.refreshToken) {
             try {
-                await this.apiRequest('/api/auth/revoke', {
+                await this.apiRequest('/auth/revoke', {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
@@ -116,10 +122,13 @@ class TokenManager {
         }, delay);
     }
     apiRequest(path, init) {
+        const baseUrl = this.getBaseUrl();
+        const fullUrl = `${baseUrl}${path}`;
+        console.warn(`[DotBotsAuth] API request: ${init.method ?? 'GET'} ${fullUrl}`);
         const headers = new Headers(init.headers);
         headers.set('X-App-Id', this.config.appId);
         headers.set('X-Environment', this.environment);
-        return fetch(`${this.config.apiUrl}${path}`, { ...init, headers });
+        return fetch(fullUrl, { ...init, headers });
     }
 }
 
@@ -195,7 +204,9 @@ class ProxyConfigManager {
     }
     async fetchConfig() {
         try {
-            const response = await fetch(`${this.apiUrl}/api/proxy/config`, {
+            const url = `${this.apiUrl}/api/proxy/config`;
+            console.warn(`[DotBotsAuth] Fetching proxy config from ${url}`);
+            const response = await fetch(url, {
                 headers: {
                     'X-App-Id': this.appId,
                     'X-Environment': this.environment,
@@ -205,10 +216,10 @@ class ProxyConfigManager {
                 throw new Error(`Proxy config request failed: ${response.status}`);
             }
             this.config = await response.json();
+            console.warn(`[DotBotsAuth] Proxy config loaded — proxyUrl: ${this.config.proxyUrl}`);
         }
         catch (err) {
-            // Non-fatal: log warning, SDK falls back to direct apiUrl
-            console.warn('[DotBotsAuth] Could not fetch proxy config, falling back to direct API:', err instanceof Error ? err.message : err);
+            console.error('[DotBotsAuth] Could not fetch proxy config:', err instanceof Error ? err.message : err);
             this.config = null;
         }
     }
@@ -219,11 +230,16 @@ class ProxyConfigManager {
         return this.config;
     }
     /**
-     * Returns the base URL to use for auth.fetch() calls.
-     * Uses the proxy if available, otherwise falls back to apiUrl.
+     * Returns the base URL to use for API calls.
+     * Returns proxyUrl if available. If not, logs an error and returns apiUrl.
      */
     getBaseUrl() {
-        return this.config !== null ? this.config.proxyUrl : this.apiUrl;
+        if (this.config !== null) {
+            console.warn(`[DotBotsAuth] getBaseUrl → ${this.config.proxyUrl}`);
+            return this.config.proxyUrl;
+        }
+        console.error('[DotBotsAuth] No proxyUrl available — proxy config was not fetched or failed. Falling back to apiUrl.');
+        return this.apiUrl;
     }
 }
 
@@ -234,8 +250,9 @@ class DotBotsAuth {
         this.initialized = false;
         this.config = config;
         this.environment = this.detectEnvironment();
+        console.warn(`[DotBotsAuth] SDK v${DotBotsAuth.SDK_VERSION} — env: ${this.environment}, appId: ${config.appId}`);
         const marketplaceOrigin = config.marketplaceOrigin ?? 'https://dotbots.boutique';
-        this.tokenManager = new TokenManager(config, this.environment, () => this.emit('tokenRefreshed'), () => this.emit('sessionExpired'));
+        this.tokenManager = new TokenManager(config, this.environment, () => this.emit('tokenRefreshed'), () => this.emit('sessionExpired'), () => this.proxyConfigManager.getBaseUrl());
         this.postMessageHandler = new PostMessageHandler(marketplaceOrigin);
         this.proxyConfigManager = new ProxyConfigManager(config.apiUrl, config.appId, this.environment);
     }
@@ -255,7 +272,7 @@ class DotBotsAuth {
         this.assertInitialized();
         if (this.cachedUser)
             return this.cachedUser;
-        const response = await this.buildRequest(`${this.config.apiUrl}/api/auth/me`);
+        const response = await this.buildRequest(`${this.proxyConfigManager.getBaseUrl()}/auth/me`);
         if (!response.ok) {
             if (response.status === 401) {
                 throw new DotBotsAuthError('UNAUTHORIZED', 'Not authorized to access this app');
@@ -312,7 +329,7 @@ class DotBotsAuth {
         }
         else {
             const redirectUri = encodeURIComponent(window.location.origin);
-            window.location.href = `${this.config.apiUrl}/api/auth/logout?redirectUri=${redirectUri}`;
+            window.location.href = `${this.config.apiUrl}/auth/logout?redirectUri=${redirectUri}`;
         }
     }
     on(event, handler) {
@@ -340,12 +357,18 @@ class DotBotsAuth {
     async initializeIframe() {
         const timeout = this.config.iframeTimeout ?? 5000;
         const code = await this.postMessageHandler.requestAuthCode(this.config.appId, timeout);
+        if (!code) {
+            console.error('[DotBotsAuth] Received empty auth code from iframe parent');
+            throw new DotBotsAuthError('CODE_EXPIRED', 'Received empty auth code from iframe parent');
+        }
+        console.warn(`[DotBotsAuth] Received auth code from iframe: ${code.substring(0, 2)}**`);
         await this.tokenManager.exchangeCode(code);
     }
     async initializeStandalone() {
         const url = new URL(window.location.href);
         const code = url.searchParams.get('code');
         if (code) {
+            console.warn(`[DotBotsAuth] Received auth code from URL: ${code.substring(0, 2)}**`);
             // Remove code from URL immediately
             url.searchParams.delete('code');
             window.history.replaceState({}, '', url.toString());
@@ -354,7 +377,7 @@ class DotBotsAuth {
         else if (!this.tokenManager.isAuthenticated()) {
             // Redirect to auth
             const redirectUri = encodeURIComponent(window.location.href);
-            window.location.href = `${this.config.apiUrl}/api/auth/authorize?appId=${this.config.appId}&redirectUri=${redirectUri}`;
+            window.location.href = `${this.config.apiUrl}/auth/authorize?appId=${this.config.appId}&redirectUri=${redirectUri}`;
         }
     }
     async buildRequest(url, options) {
@@ -386,6 +409,7 @@ class DotBotsAuth {
         }
     }
 }
+DotBotsAuth.SDK_VERSION = '1.0.7';
 
 exports.DotBotsAuth = DotBotsAuth;
 exports.DotBotsAuthError = DotBotsAuthError;

package/dist/esm/index.js

@@ -8,7 +8,7 @@ class DotBotsAuthError extends Error {
 }
 
 class TokenManager {
-    constructor(config, environment, onRefreshed, onSessionExpired) {
+    constructor(config, environment, onRefreshed, onSessionExpired, getBaseUrl) {
         this.accessToken = null;
         this.refreshToken = null;
         this.expiresAt = 0;
@@ -17,6 +17,7 @@ class TokenManager {
         this.environment = environment;
         this.onRefreshed = onRefreshed;
         this.onSessionExpired = onSessionExpired;
+        this.getBaseUrl = getBaseUrl;
     }
     setTokens(tokens) {
         this.accessToken = tokens.accessToken;
@@ -31,7 +32,12 @@ class TokenManager {
         return this.accessToken !== null && Date.now() < this.expiresAt;
     }
     async exchangeCode(code) {
-        const response = await this.apiRequest('/api/auth/token', {
+        if (!code) {
+            console.error('[DotBotsAuth] exchangeCode called without a code — aborting token exchange');
+            throw new DotBotsAuthError('CODE_EXPIRED', 'No auth code provided');
+        }
+        console.warn(`[DotBotsAuth] Exchanging auth code: ${code.substring(0, 2)}**`);
+        const response = await this.apiRequest('/auth/token', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ code, appId: this.config.appId }),
@@ -51,7 +57,7 @@ class TokenManager {
         }
         let response;
         try {
-            response = await this.apiRequest('/api/auth/refresh', {
+            response = await this.apiRequest('/auth/refresh', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({
@@ -72,7 +78,7 @@ class TokenManager {
     async revoke() {
         if (this.accessToken && this.refreshToken) {
             try {
-                await this.apiRequest('/api/auth/revoke', {
+                await this.apiRequest('/auth/revoke', {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
@@ -114,10 +120,13 @@ class TokenManager {
         }, delay);
     }
     apiRequest(path, init) {
+        const baseUrl = this.getBaseUrl();
+        const fullUrl = `${baseUrl}${path}`;
+        console.warn(`[DotBotsAuth] API request: ${init.method ?? 'GET'} ${fullUrl}`);
         const headers = new Headers(init.headers);
         headers.set('X-App-Id', this.config.appId);
         headers.set('X-Environment', this.environment);
-        return fetch(`${this.config.apiUrl}${path}`, { ...init, headers });
+        return fetch(fullUrl, { ...init, headers });
     }
 }
 
@@ -193,7 +202,9 @@ class ProxyConfigManager {
     }
     async fetchConfig() {
         try {
-            const response = await fetch(`${this.apiUrl}/api/proxy/config`, {
+            const url = `${this.apiUrl}/api/proxy/config`;
+            console.warn(`[DotBotsAuth] Fetching proxy config from ${url}`);
+            const response = await fetch(url, {
                 headers: {
                     'X-App-Id': this.appId,
                     'X-Environment': this.environment,
@@ -203,10 +214,10 @@ class ProxyConfigManager {
                 throw new Error(`Proxy config request failed: ${response.status}`);
             }
             this.config = await response.json();
+            console.warn(`[DotBotsAuth] Proxy config loaded — proxyUrl: ${this.config.proxyUrl}`);
         }
         catch (err) {
-            // Non-fatal: log warning, SDK falls back to direct apiUrl
-            console.warn('[DotBotsAuth] Could not fetch proxy config, falling back to direct API:', err instanceof Error ? err.message : err);
+            console.error('[DotBotsAuth] Could not fetch proxy config:', err instanceof Error ? err.message : err);
             this.config = null;
         }
     }
@@ -217,11 +228,16 @@ class ProxyConfigManager {
         return this.config;
     }
     /**
-     * Returns the base URL to use for auth.fetch() calls.
-     * Uses the proxy if available, otherwise falls back to apiUrl.
+     * Returns the base URL to use for API calls.
+     * Returns proxyUrl if available. If not, logs an error and returns apiUrl.
      */
     getBaseUrl() {
-        return this.config !== null ? this.config.proxyUrl : this.apiUrl;
+        if (this.config !== null) {
+            console.warn(`[DotBotsAuth] getBaseUrl → ${this.config.proxyUrl}`);
+            return this.config.proxyUrl;
+        }
+        console.error('[DotBotsAuth] No proxyUrl available — proxy config was not fetched or failed. Falling back to apiUrl.');
+        return this.apiUrl;
     }
 }
 
@@ -232,8 +248,9 @@ class DotBotsAuth {
         this.initialized = false;
         this.config = config;
         this.environment = this.detectEnvironment();
+        console.warn(`[DotBotsAuth] SDK v${DotBotsAuth.SDK_VERSION} — env: ${this.environment}, appId: ${config.appId}`);
         const marketplaceOrigin = config.marketplaceOrigin ?? 'https://dotbots.boutique';
-        this.tokenManager = new TokenManager(config, this.environment, () => this.emit('tokenRefreshed'), () => this.emit('sessionExpired'));
+        this.tokenManager = new TokenManager(config, this.environment, () => this.emit('tokenRefreshed'), () => this.emit('sessionExpired'), () => this.proxyConfigManager.getBaseUrl());
         this.postMessageHandler = new PostMessageHandler(marketplaceOrigin);
         this.proxyConfigManager = new ProxyConfigManager(config.apiUrl, config.appId, this.environment);
     }
@@ -253,7 +270,7 @@ class DotBotsAuth {
         this.assertInitialized();
         if (this.cachedUser)
             return this.cachedUser;
-        const response = await this.buildRequest(`${this.config.apiUrl}/api/auth/me`);
+        const response = await this.buildRequest(`${this.proxyConfigManager.getBaseUrl()}/auth/me`);
         if (!response.ok) {
             if (response.status === 401) {
                 throw new DotBotsAuthError('UNAUTHORIZED', 'Not authorized to access this app');
@@ -310,7 +327,7 @@ class DotBotsAuth {
         }
         else {
             const redirectUri = encodeURIComponent(window.location.origin);
-            window.location.href = `${this.config.apiUrl}/api/auth/logout?redirectUri=${redirectUri}`;
+            window.location.href = `${this.config.apiUrl}/auth/logout?redirectUri=${redirectUri}`;
         }
     }
     on(event, handler) {
@@ -338,12 +355,18 @@ class DotBotsAuth {
     async initializeIframe() {
         const timeout = this.config.iframeTimeout ?? 5000;
         const code = await this.postMessageHandler.requestAuthCode(this.config.appId, timeout);
+        if (!code) {
+            console.error('[DotBotsAuth] Received empty auth code from iframe parent');
+            throw new DotBotsAuthError('CODE_EXPIRED', 'Received empty auth code from iframe parent');
+        }
+        console.warn(`[DotBotsAuth] Received auth code from iframe: ${code.substring(0, 2)}**`);
         await this.tokenManager.exchangeCode(code);
     }
     async initializeStandalone() {
         const url = new URL(window.location.href);
         const code = url.searchParams.get('code');
         if (code) {
+            console.warn(`[DotBotsAuth] Received auth code from URL: ${code.substring(0, 2)}**`);
             // Remove code from URL immediately
             url.searchParams.delete('code');
             window.history.replaceState({}, '', url.toString());
@@ -352,7 +375,7 @@ class DotBotsAuth {
         else if (!this.tokenManager.isAuthenticated()) {
             // Redirect to auth
             const redirectUri = encodeURIComponent(window.location.href);
-            window.location.href = `${this.config.apiUrl}/api/auth/authorize?appId=${this.config.appId}&redirectUri=${redirectUri}`;
+            window.location.href = `${this.config.apiUrl}/auth/authorize?appId=${this.config.appId}&redirectUri=${redirectUri}`;
         }
     }
     async buildRequest(url, options) {
@@ -384,5 +407,6 @@ class DotBotsAuth {
         }
     }
 }
+DotBotsAuth.SDK_VERSION = '1.0.7';
 
 export { DotBotsAuth, DotBotsAuthError };

package/dist/types/DotBotsAuth.d.ts

@@ -8,6 +8,7 @@ export declare class DotBotsAuth {
     private readonly listeners;
     private cachedUser;
     private initialized;
+    static readonly SDK_VERSION = "1.0.7";
     constructor(config: DotBotsConfig);
     initialize(): Promise<void>;
     getUser(): Promise<DotBotsUser>;

package/dist/types/ProxyConfigManager.d.ts

@@ -9,8 +9,8 @@ export declare class ProxyConfigManager {
     getProxyUrl(): string | null;
     getConfig(): DotBotsProxyConfig | null;
     /**
-     * Returns the base URL to use for auth.fetch() calls.
-     * Uses the proxy if available, otherwise falls back to apiUrl.
+     * Returns the base URL to use for API calls.
+     * Returns proxyUrl if available. If not, logs an error and returns apiUrl.
      */
     getBaseUrl(): string;
 }

package/dist/types/TokenManager.d.ts

@@ -8,7 +8,8 @@ export declare class TokenManager {
     private readonly environment;
     private readonly onRefreshed;
     private readonly onSessionExpired;
-    constructor(config: DotBotsConfig, environment: DotBotsEnvironment, onRefreshed: () => void, onSessionExpired: () => void);
+    private readonly getBaseUrl;
+    constructor(config: DotBotsConfig, environment: DotBotsEnvironment, onRefreshed: () => void, onSessionExpired: () => void, getBaseUrl: () => string);
     setTokens(tokens: TokenPair): void;
     getAccessToken(): string | null;
     isAuthenticated(): boolean;

package/dist/types/index.js

@@ -8,7 +8,7 @@ class DotBotsAuthError extends Error {
 }
 
 class TokenManager {
-    constructor(config, environment, onRefreshed, onSessionExpired) {
+    constructor(config, environment, onRefreshed, onSessionExpired, getBaseUrl) {
         this.accessToken = null;
         this.refreshToken = null;
         this.expiresAt = 0;
@@ -17,6 +17,7 @@ class TokenManager {
         this.environment = environment;
         this.onRefreshed = onRefreshed;
         this.onSessionExpired = onSessionExpired;
+        this.getBaseUrl = getBaseUrl;
     }
     setTokens(tokens) {
         this.accessToken = tokens.accessToken;
@@ -31,7 +32,12 @@ class TokenManager {
         return this.accessToken !== null && Date.now() < this.expiresAt;
     }
     async exchangeCode(code) {
-        const response = await this.apiRequest('/api/auth/token', {
+        if (!code) {
+            console.error('[DotBotsAuth] exchangeCode called without a code — aborting token exchange');
+            throw new DotBotsAuthError('CODE_EXPIRED', 'No auth code provided');
+        }
+        console.warn(`[DotBotsAuth] Exchanging auth code: ${code.substring(0, 2)}**`);
+        const response = await this.apiRequest('/auth/token', {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({ code, appId: this.config.appId }),
@@ -51,7 +57,7 @@ class TokenManager {
         }
         let response;
         try {
-            response = await this.apiRequest('/api/auth/refresh', {
+            response = await this.apiRequest('/auth/refresh', {
                 method: 'POST',
                 headers: { 'Content-Type': 'application/json' },
                 body: JSON.stringify({
@@ -72,7 +78,7 @@ class TokenManager {
     async revoke() {
         if (this.accessToken && this.refreshToken) {
             try {
-                await this.apiRequest('/api/auth/revoke', {
+                await this.apiRequest('/auth/revoke', {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
@@ -114,10 +120,13 @@ class TokenManager {
         }, delay);
     }
     apiRequest(path, init) {
+        const baseUrl = this.getBaseUrl();
+        const fullUrl = `${baseUrl}${path}`;
+        console.warn(`[DotBotsAuth] API request: ${init.method ?? 'GET'} ${fullUrl}`);
         const headers = new Headers(init.headers);
         headers.set('X-App-Id', this.config.appId);
         headers.set('X-Environment', this.environment);
-        return fetch(`${this.config.apiUrl}${path}`, { ...init, headers });
+        return fetch(fullUrl, { ...init, headers });
     }
 }
 
@@ -193,7 +202,9 @@ class ProxyConfigManager {
     }
     async fetchConfig() {
         try {
-            const response = await fetch(`${this.apiUrl}/api/proxy/config`, {
+            const url = `${this.apiUrl}/api/proxy/config`;
+            console.warn(`[DotBotsAuth] Fetching proxy config from ${url}`);
+            const response = await fetch(url, {
                 headers: {
                     'X-App-Id': this.appId,
                     'X-Environment': this.environment,
@@ -203,10 +214,10 @@ class ProxyConfigManager {
                 throw new Error(`Proxy config request failed: ${response.status}`);
             }
             this.config = await response.json();
+            console.warn(`[DotBotsAuth] Proxy config loaded — proxyUrl: ${this.config.proxyUrl}`);
         }
         catch (err) {
-            // Non-fatal: log warning, SDK falls back to direct apiUrl
-            console.warn('[DotBotsAuth] Could not fetch proxy config, falling back to direct API:', err instanceof Error ? err.message : err);
+            console.error('[DotBotsAuth] Could not fetch proxy config:', err instanceof Error ? err.message : err);
             this.config = null;
         }
     }
@@ -217,11 +228,16 @@ class ProxyConfigManager {
         return this.config;
     }
     /**
-     * Returns the base URL to use for auth.fetch() calls.
-     * Uses the proxy if available, otherwise falls back to apiUrl.
+     * Returns the base URL to use for API calls.
+     * Returns proxyUrl if available. If not, logs an error and returns apiUrl.
      */
     getBaseUrl() {
-        return this.config !== null ? this.config.proxyUrl : this.apiUrl;
+        if (this.config !== null) {
+            console.warn(`[DotBotsAuth] getBaseUrl → ${this.config.proxyUrl}`);
+            return this.config.proxyUrl;
+        }
+        console.error('[DotBotsAuth] No proxyUrl available — proxy config was not fetched or failed. Falling back to apiUrl.');
+        return this.apiUrl;
     }
 }
 
@@ -232,8 +248,9 @@ class DotBotsAuth {
         this.initialized = false;
         this.config = config;
         this.environment = this.detectEnvironment();
+        console.warn(`[DotBotsAuth] SDK v${DotBotsAuth.SDK_VERSION} — env: ${this.environment}, appId: ${config.appId}`);
         const marketplaceOrigin = config.marketplaceOrigin ?? 'https://dotbots.boutique';
-        this.tokenManager = new TokenManager(config, this.environment, () => this.emit('tokenRefreshed'), () => this.emit('sessionExpired'));
+        this.tokenManager = new TokenManager(config, this.environment, () => this.emit('tokenRefreshed'), () => this.emit('sessionExpired'), () => this.proxyConfigManager.getBaseUrl());
         this.postMessageHandler = new PostMessageHandler(marketplaceOrigin);
         this.proxyConfigManager = new ProxyConfigManager(config.apiUrl, config.appId, this.environment);
     }
@@ -253,7 +270,7 @@ class DotBotsAuth {
         this.assertInitialized();
         if (this.cachedUser)
             return this.cachedUser;
-        const response = await this.buildRequest(`${this.config.apiUrl}/api/auth/me`);
+        const response = await this.buildRequest(`${this.proxyConfigManager.getBaseUrl()}/auth/me`);
         if (!response.ok) {
             if (response.status === 401) {
                 throw new DotBotsAuthError('UNAUTHORIZED', 'Not authorized to access this app');
@@ -310,7 +327,7 @@ class DotBotsAuth {
         }
         else {
             const redirectUri = encodeURIComponent(window.location.origin);
-            window.location.href = `${this.config.apiUrl}/api/auth/logout?redirectUri=${redirectUri}`;
+            window.location.href = `${this.config.apiUrl}/auth/logout?redirectUri=${redirectUri}`;
         }
     }
     on(event, handler) {
@@ -338,12 +355,18 @@ class DotBotsAuth {
     async initializeIframe() {
         const timeout = this.config.iframeTimeout ?? 5000;
         const code = await this.postMessageHandler.requestAuthCode(this.config.appId, timeout);
+        if (!code) {
+            console.error('[DotBotsAuth] Received empty auth code from iframe parent');
+            throw new DotBotsAuthError('CODE_EXPIRED', 'Received empty auth code from iframe parent');
+        }
+        console.warn(`[DotBotsAuth] Received auth code from iframe: ${code.substring(0, 2)}**`);
         await this.tokenManager.exchangeCode(code);
     }
     async initializeStandalone() {
         const url = new URL(window.location.href);
         const code = url.searchParams.get('code');
         if (code) {
+            console.warn(`[DotBotsAuth] Received auth code from URL: ${code.substring(0, 2)}**`);
             // Remove code from URL immediately
             url.searchParams.delete('code');
             window.history.replaceState({}, '', url.toString());
@@ -352,7 +375,7 @@ class DotBotsAuth {
         else if (!this.tokenManager.isAuthenticated()) {
             // Redirect to auth
             const redirectUri = encodeURIComponent(window.location.href);
-            window.location.href = `${this.config.apiUrl}/api/auth/authorize?appId=${this.config.appId}&redirectUri=${redirectUri}`;
+            window.location.href = `${this.config.apiUrl}/auth/authorize?appId=${this.config.appId}&redirectUri=${redirectUri}`;
         }
     }
     async buildRequest(url, options) {
@@ -384,5 +407,6 @@ class DotBotsAuth {
         }
     }
 }
+DotBotsAuth.SDK_VERSION = '1.0.7';
 
 export { DotBotsAuth, DotBotsAuthError };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dotbots-boutique/auth-sdk",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Authentication SDK for DotBots marketplace apps",
   "license": "MIT",
   "type": "module",