# You have an app with its own accounts

> Your app has its own login, on any system. A signed-in user links their STX account once, and your app acts for them with scoped tokens.

Source: https://docs.stxapp.io/oauth/connect-your-stx-account/

> **Availability.** Available on US demo now. Live access is coming soon in the US and Ontario. See [Environments](https://docs.stxapp.io/environments/).

Use this when your app already has its own users and its own login. A user who is signed in to your app chooses **Connect your STX account**, signs in on STX, approves the access you ask for, and comes back linked. Your app stores their tokens against your own user id.

STX never sees your login and nothing about STX is configured in it. Your server links the STX account after your user has logged in, whichever way they did.

How an app with its own login links STX accounts:

1. **Your login**: Any system
2. **Your app knows who the user is**: Your own user id
3. **The user links their STX account**: On an STX page, once, then back to your app
4. **Your app holds tokens**: And trades for them

This works with any login system: your own passwords, Auth0, Clerk, Firebase or anything else. Nothing on the STX side depends on which one you use.

Not your situation? See the [OAuth overview](/oauth/#start-from-where-you-are).

## What the member sees

1. In your app, signed in as your user, they choose **Connect your STX account**.
2. STX asks them to sign in, or to create an account if they have none.
3. STX shows your app's name and logo and the access you asked for. They choose **Allow**.
4. They are back in your app, which now shows their STX balance, positions and orders.

They can disconnect in your app, or from **Connected apps** in their STX account, at any time.

## Step by step

Who talks to whom. STX only ever meets your app's server and, for one step, the user's browser.

## What you build

Underneath, this is the OAuth 2.0 authorization code flow with PKCE, run from your server.

| Step | Your server does | Details |
| --- | --- | --- |
| Link | Redirects the user to `/oauth/authorize` with a PKCE challenge and a `state` tied to their session in your app | [Authorization code flow](/oauth/authorization-flow/) |
| Callback | Checks `state`, exchanges the `code` for an access token and a refresh token, and stores both under your user id | [Step 4](/oauth/authorization-flow/#4-exchange-the-code-for-tokens) |
| Act | Calls `/api/v1` and the WebSocket with the access token, within the scopes the member approved | [Scopes](/oauth/scopes/) |
| Stay linked | Refreshes the access token, and stores the new refresh token each time | [Refreshing](/oauth/tokens-and-security/#refreshing) |
| Unlink | Revokes the refresh token, which ends the member's grant | [Revoking](/oauth/tokens-and-security/#revoking) |

Your user id is the key. You do not need to know who the member is on STX to act for them; ask for `profile.read` if you want to show their STX handle.

## What you need from STX

A registered app of type **Web app**, with your callback URL and the member scopes you will request. See [Get demo access](/apps/overview/#get-demo-access).

## When the link does not complete

The member is returned to your callback with `error` instead of `code`. Show your app's not-linked state and let them try again.

| `error` | Meaning |
| --- | --- |
| `access_denied` | The member chose **Deny**, or cannot use STX right now. |
| `account_pending` | The member has not finished STX verification. Show a "finish verifying" message. See [Members still being verified](/oauth/members-being-verified/). |

## With the TypeScript SDK

`OAuthClient` runs the link, the token storage, the refresh and the unlink. See [With the TypeScript SDK](/apps/typescript-sdk/#connect-your-stx-account).

## Live example

See it working: the [Sideline](https://github.com/stxapp/stx-isv-demo) demo app, built on this pattern with its own users, a **Connect STX** button, and trading for the linked member. Its own login happens to use Privy, as one example. Try it at [sideline.sportsxapp.com](https://sideline.sportsxapp.com).