Return to My Kanzen · Login setup
MY KANZEN — LOGIN PROOF v3.0 20 September 2026 Deployment file: My_Kanzen_Login_Proof_v3_0.zip App: https://app.kanzenmartialarts.co.uk WHAT THIS ADDS A Wix-hosted sign-in, a read of the signed-in Wix member's name/email/ID, persistent Cloudflare sessions, and sign-out. The existing notification receiver is still v2.6 because its confirmed appearance has not changed. This is the login proof, not the migrated member portal. It does not read AccountHolder, TrainingMembers, Memberships, medical information or documents. It does not change payments, cancellations, GoCardless or Wix collection permissions. No Wix Client secret or admin API key is required. 1. UPLOAD THE NEW ZIP Cloudflare > Workers & Pages > my-kanzen > Create deployment. Choose Production and upload My_Kanzen_Login_Proof_v3_0.zip. Use the ZIP directly or its extracted contents, with index.html and _worker.js at the upload root (not inside an extra folder). 2. CREATE THE SESSION DATABASE Cloudflare > Storage & databases > D1 SQL Database > Create database. Name: my-kanzen-auth Open its Console. Open https://app.kanzenmartialarts.co.uk/auth-database.sql in a separate tab. Copy all that SQL, paste it into the database console and run it. If the console accepts one statement at a time, run each semicolon-terminated statement separately. There are four statements. They are safe to run again. These are new Cloudflare tables; they do not count as Wix CMS items. 3. CONNECT THE DATABASE TO THE APP Workers & Pages > my-kanzen > Settings > Bindings > Add > D1 database. Use Production, where an environment selector is present. Variable name (exact): AUTH_DB Database: my-kanzen-auth Save. 4. ADD THE SESSION ENCRYPTION KEY Open https://app.kanzenmartialarts.co.uk/auth-setup.html on your laptop. Click Generate login secret, then Copy login secret. In Cloudflare, my-kanzen > Settings > Variables and Secrets > Add: Name: AUTH_SESSION_KEY Type: Secret Environment: Production Value: paste the generated 64-character value Save it. Keep a private copy; do not send it in chat. Keep VAPID_PRIVATE_JWK and TEST_ACCESS_KEY unchanged. Leave the Wix Client secret blank. It is not this key. 5. DEPLOY THE SAME ZIP AGAIN Bindings and secrets take effect on a new deployment. Upload My_Kanzen_Login_Proof_v3_0.zip again as Production. 6. TEST LOGIN ON THE LAPTOP FIRST Open https://app.kanzenmartialarts.co.uk/#login-check and refresh. The footer should say Login proof v3.0. In Wix member login, click Check sign-in. It should say Ready. Click Sign in with Wix. Use an existing test MEMBER account for the Studio site, such as Barry Allen. These are member credentials, not your Wix owner/dashboard credentials. Wix may already remember your browser login and skip its password screen. On return, confirm the correct name, email and Wix member ID appear. Close and reopen the page: it should still recognise that member. Click Sign out: it should clear the app session, visit Wix's sign-out page, and return. Check sign-in should then show that you are signed out. 7. TEST THE CLOUDFlARE APP ON THE PHONE Use the app installed from app.kanzenmartialarts.co.uk (not the older test. kanzenmartialarts.co.uk Wix installation). Start with Chrome if you want to check the browser flow first, then test the installed app separately. Sign in and confirm the returned identity; close/reopen and test sign-out. We still need this live test to confirm Wix redirects and Android app handoff. Do not reinstall or reauthorise push just to deploy this update. WIX CLIENT SETTINGS (ALREADY ENTERED) Client ID: e5d468e5-f296-465b-a79a-cb30ade1108e Allowed redirect domain: https://app.kanzenmartialarts.co.uk Allowed authorization redirect URI: https://app.kanzenmartialarts.co.uk/api/auth/callback Login URL: blank Client secret: blank The callback must match exactly, including its path and no trailing slash. The Wix site attached to this client must be published. IF THERE IS AN ERROR Share the short error code and Wix status number shown on the page. Do not share passwords, login URLs containing a code, cookies, keys or tokens. AUTH_DB_MISSING: check the Production D1 binding and redeploy. AUTH_SESSION_KEY_MISSING: check the Production secret and redeploy. AUTH_DATABASE_SETUP_REQUIRED: run the SQL in the database selected by AUTH_DB. WIX_LOGIN_REDIRECT: check the client belongs to the published Studio site and that the exact callback is allowed; leave the Login URL empty. LOGIN_STATE_INVALID / LOGIN_EXPIRED_OR_USED: return to the main page, start a fresh login in the same browser and complete it within ten minutes. WIX_MEMBER_READ: share the status number; this means the current-member API read has not succeeded. It is not proof of an AccountHolder mapping problem. SESSION BEHAVIOUR / PROOF LIMITS The browser holds only a random, HttpOnly/Secure, host-only session cookie. Cloudflare stores its hash and encrypted Wix tokens. Page scripts do not get access or refresh tokens. The auth callback strips the URL fragment before posting the one-use code. State and PKCE are checked; the database atomically consumes each valid login flow. Session tokens are encrypted with AES-GCM. Member details are fetched from Wix and filtered to name/email/member ID. They are not saved to the database, localStorage or an offline cache. Sessions have a rolling 90-day inactivity limit, renewed at most once per day. Wix token revocation, account blocking, cleared browser data or key changes can require an earlier sign-in. Closing and reopening alone does not clear login. Expired access tokens are refreshed server-side; the refresh path has been locally tested, but a real long-running Wix session still needs confirmation. Sign-out deletes the Cloudflare session first, then requests Wix hosted logout. If Wix logout fails, the page explicitly reports local sign-out only. Expired rows are cleaned in bounded batches at the next login attempt. Push remains an independent device test; it is not yet linked to a signed-in member and sign-out does not unsubscribe that test device. Before member rollout: prove AccountHolder ownership, protected family/member access, role restrictions, device revocation, rate limiting and real browser behaviour. The present page is for our own login test. VALIDATION Locally tested with Node WebCrypto, real SQLite and mocked Wix API responses: - REST request fields and PKCE challenge/verifier match. - Same-origin POST checks, request size limits, missing config and cookies. - Wrong state, expired flow, duplicate and concurrent callback rejection. - Encrypted database tokens and opaque secure cookies. - Two-account separation and only filtered current-member data returned. - Persistent session restore and expired-token refresh. - Refresh lock, concurrent logout, invalid refresh and changed/blocked member. - Logout remains effective when Wix's logout endpoint fails. - Browser secret generation and callback URL cleanup. - All prior push tests, including signature and Cloudflare redirect handling. No real member password was used by the assistant. Live login is not yet verified. SOURCE DOCUMENTATION https://dev.wix.com/docs/go-headless/authentication/members/wix-login-page/add-a-wix-login-page-rest https://dev.wix.com/docs/go-headless/authentication/visitors/authenticate-visitors-rest https://dev.wix.com/docs/api-reference/business-management/headless/authentication/retrieve-tokens https://dev.wix.com/docs/api-reference/crm/members-contacts/members/member-management/members/get-my-member https://developers.cloudflare.com/pages/functions/bindings/ https://developers.cloudflare.com/d1/get-started/