Skip to main content
Member storefront is in a limited pilot. This guide requires the updated storefront authentication release, including the new sign-out route. Confirm that the release is deployed and member storefront is enabled for your company before publishing these links.
Use member_routes.sign_in and member_routes.sign_out in your theme. Fluid handles authentication and the session; you choose the markup, text, classes, and styles. Place ordinary anchors in your storefront header or member layout:
Replace the example classes with your theme’s classes. You can put an icon or other content inside either anchor. No Fluid-specific styling, form tag, logout JavaScript, or CSRF-token variable is required. Keep these URLs independent of the visitor’s session. A cached storefront page can be reused for signed-in and signed-out visitors, so do not use Liquid conditions on member to choose which link that page includes. member is available only in authorized member-page renders. The existence of member_routes.sign_out does not mean a visitor is signed in. Use the variables instead of hardcoding your company domain, the auth domain, or a callback URL. Local and deployed environments can use different authentication hosts.

​
What happens when you sign in

  1. On the storefront, the sign-in link starts authentication on the current host and redirects to your company’s Fluid sign-in screen. In production, Fluid hosts authentication at auth.fluid.app.
  2. After successful authentication, the browser returns to the same host’s session callback. Fluid verifies the result and creates the member session cookie.
  3. The browser returns to the requested local path. If no safe return path is available, it returns to / on that host.
Signing in from a storefront returns to that storefront, including a custom domain. Signing in from the account host returns to the account host. Your theme should not generate authentication tokens, store them in browser storage, or build the callback itself. member_routes.root is the root of the current host. It does not switch between the storefront and the account host.

​
Sign-in always uses hosted authentication

Both hosts use /auth/sign_in to redirect directly to the configured authentication app. It does not render a members_login theme template. Your theme does not need a login template or its own password form. A guest who opens a protected member page also goes directly to hosted authentication and returns to the requested page after signing in.

​
What happens when you sign out

Following member_routes.sign_out ends the member session on the current host and redirects to that host’s root. Fluid also revokes the member’s company-scoped real-time connections. If that cleanup fails, sign-out reports a failure and keeps the cookie so the member can retry. Sessions are currently scoped to the host. Signing in on the storefront does not automatically sign you in on the account host, and signing out does not clear the other host’s cookie. It also does not sign you out of the hosted authentication provider. Real-time connection revocation can affect other tabs for the same member and company. Sign-out uses a GET navigation. A link preview, prefetch, or navigation from another site can therefore sign a visitor out. Keep this as an explicit user-clicked link and do not prefetch or automatically request it. This behavior applies to sign-out; it does not remove protection from other actions.

​
Update an older theme

After the updated authentication release is deployed:
  1. Replace old /login links with member_routes.sign_in. Remove unused members_login templates.
  2. Replace old sign-out forms and references to the retired session-delete route with the anchor above.
  3. Remove member_routes.csrf_token, hidden method overrides, and custom code used only to submit that old logout form.
  4. Keep content_for_header in your layout; system screens and other theme features still need the normal header output.
  5. Publish or regenerate your theme’s HTML so cached storefront pages receive the new links.
  • Start signed out on a storefront page, follow Sign in, and confirm you return to that storefront page after authentication.
  • Follow Sign out and confirm the session ends on that host.
  • On the account host, sign in, open a protected member page, and sign out. Reopening the protected page should require authentication.
  • Follow the sign-in link on the account host and confirm it uses /auth/sign_in and redirects directly to hosted authentication.
  • Check cached storefront HTML as both a guest and a member. It should contain stable auth links and no private member data or session token.
For the complete field reference, see Member Liquid variables.