App Auth SDK

Use @korve-dev/app-auth through an explicit browser or server entrypoint.

@korve-dev/app-auth is release-ready in the repository but is not yet available from the public npm registry. Do not add it as an npm dependency until anonymous registry installation succeeds. The examples currently use the checked-out workspace package.

import { createKorveAuthClient } from "@korve-dev/app-auth/browser";

const auth = createKorveAuthClient({ apiUrl: "https://api.korve.dev", project: "storefront" });
await auth.signInWithGoogle(`${location.origin}/auth/callback`);
const session = await auth.handleOAuthCallback();

The default browser storage is compatible with client-only applications, but an XSS bug could read its tokens. For server-rendered and security-sensitive apps, exchange callbacks and rotate refresh tokens in server routes. Store application-owned tokens in Secure, HttpOnly, SameSite=Lax __Host- cookies with no Domain attribute, and apply CSRF protection to writes.

import { createKorveAuthServerClient } from "@korve-dev/app-auth/server";

const auth = createKorveAuthServerClient({
  apiUrl: "https://api.korve.dev",
  project: "storefront",
  accessToken,
});
const user = await auth.getUser();

App-user tokens are separate from operator API keys and runtime tokens. Configure policy and inspect password and magic-link behavior in App Auth, then inspect the endpoint contract in the App Auth API.

Start

Core concepts

Agents

Build

Data and work

Operate

CLI reference

API reference

App Auth SDK