NeuralStacks
ReelScout
Walking skeleton. Sign-in goes through the NeuralStacks central SSO — the Next.js server is the confidential OIDC client (authorization code + PKCE S256); tokens never reach the browser.
SSO unavailable? Break-glass access (owners only)