Nightmare!! That’s the only word for syncing login state across two separate apps.

A few months back we were working on our prompt optimisation product.

It’s split across a web app and a Chrome extension – you sign up and manage everything on the website, but you actually run the optimisation from the extension popup.

And one requirement sounded really simple when someone first said it out loud: “the extension should know if the user is logged in.”

Apparently that shouldn’t have been a big deal.

Then we actually sat down to build it, and it turned out to be a pain in the back.

Because a web app and a Chrome extension aren’t even the same environment. The website has localStorage, a normal tab that stays alive. The extension popup runs in its own isolated bubble, and can be destroyed the moment it loses focus.

So the two “obvious” fixes just didn’t work. The website and extension weren’t sharing state automatically. The website had its own localStorage, while the extension had its own storage and its own lifecycle. 

Which meant logging in on the website didn’t update the extension. Logging out from the extension didn’t update the website. Two apps, same product, completely out of sync.

So we stopped thinking of it as “two apps that each need a login screen” and started treating it as one auth system with two clients.

We broke it into three questions – how does each app find the current state when it loads, how does an app that’s already open hear about a change, and what happens when the state can’t be trusted anymore.

We tried a quick localStorage-flag shortcut first. It broke instantly the moment we logged out from the extension while the website tab was open in the background.

That’s what pushed us toward the real fix – the backend became the single source of truth. Neither app trusted a cached token by itself; it got verified against the backend at the moments that actually mattered. The website listened for storage events to catch changes from other tabs. The extension used chrome.storage, an onChanged listener, plus messaging between the background worker and the popup. And logout was built to work in both directions, not just the one we happened to build first.

Now it just feels like one product. Sign up once, and both sides agree on who you are, every time.

You can try it at promptoptimise.com. It’s free!

We’re building a lot of interesting stuff and I’ll keep sharing what we learn along the way.

Follow to stay connected.