# Triggering account creation/login on external service when a user logs in on discourse

**URL:** <https://meta.discourse.org/t/triggering-account-creation-login-on-external-service-when-a-user-logs-in-on-discourse/340359>\
**Category:** Development\
**Created:** [December 4, 2024, 1:18pm UTC](https://meta.discourse.org/t/triggering-account-creation-login-on-external-service-when-a-user-logs-in-on-discourse/340359 "2024-12-04T13:18:09Z")\
**Posts on this page:** 1\
**Showing post:** 1

<div class="post-metadata">

**Author:** ![Chris\_Dawson](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/chris_dawson/32/184486_2.png) [@Chris\_Dawson](https://meta.discourse.org/u/Chris_Dawson)\
**Post date:** [December 4, 2024, 1:18pm UTC](https://meta.discourse.org/t/triggering-account-creation-login-on-external-service-when-a-user-logs-in-on-discourse/340359/1 "2024-12-04T13:18:09Z")

</div>

I have a JS plugin on my discourse site. This JS uses pocketbase to store data. Pocketbase is a “serverless” sqlite service that permits me to store files and JSON blobs. Pocketbase has a terrific JWT-based auth system so that once a user has an auth token, then can securely store data directly into pocketbase (without proxying through a backend server, etc.) directly from JS on the client side.

I am trying to figure out a way where I can generate a login on the pocketbase side automatically when a user logs into discourse.

My first attempt was to have the JS plugin make a call to a path on the server and include discourse auth cookies. Then, for that path, let nginx proxy it to a service (“login proxy”) which can decode the auth cookies and determine who the user is. With verified user information, the login proxy can then make a special call to pocketbase and get back a pocketbase auth cookie, and then send back that pocketbase auth cookie which the client side JS can use to make subsequent requests directly to pocketbase.

But, I’m having trouble decoding the discourse auth cookies (I imagine `_t` is the right cookie, but I don’t see a simple way to get at the user details and am worried that structure might change anyway).

Is there a smarter way to securely get at the email address of a logged in user? I don’t think this should happen on the client side, and would prefer to do this on the server side for obvious security reasons.

---

_[View the full topic](https://meta.discourse.org/t/triggering-account-creation-login-on-external-service-when-a-user-logs-in-on-discourse/340359)._