@authplane/sdk

OAuth 2.1 + JWT validation primitives for Node.js. Verify access tokens from Authplane's authserver in a few lines, or use the OAuth client to obtain and exchange tokens yourself.

Ships two subpath entry points:

• @authplane/sdk/core — resource-server primitives (JWT validation, RFC 8414 discovery, JWKS, RFC 9728 Protected Resource Metadata, RFC 7662 introspection, DPoP).
• @authplane/sdk/auth — stateless OAuth protocol primitives (client-credentials, RFC 8693 token exchange, introspection, revocation, DPoP signer).

Install

npm install @authplane/sdk

Requires Node.js 20 LTS or newer. TypeScript consumers need "moduleResolution": "bundler" | "node16" | "nodenext".

Validate an access token

import { AuthplaneClient } from "@authplane/sdk/core";

const client = await AuthplaneClient.create({ issuer: "https://auth.example.com" });

const resource = client.resource({
  resource: "https://api.example.com",
  scopes: ["read"],
});

const claims = await resource.verify(bearerToken);
claims.requireScope("read");

Obtain an access token

import { AuthplaneClient } from "@authplane/sdk/core";

const client = await AuthplaneClient.create({
  issuer: "https://auth.example.com",
  auth: { clientId: "my-client-id", clientSecret: "my-client-secret" },
});

const token = await client.clientCredentials(["tools/read"], ["https://api.example.com"]);
console.log(token.accessToken);

Local development

The default FetchSettings reject plaintext http:// issuers (SSRF protection). When pointing the SDK at a local authserver — typically http://localhost:9000 — pass devMode: true to relax the network policy:

const client = await AuthplaneClient.create({
  issuer: "http://localhost:9000",
  devMode: true,
});

Warning: Never set devMode: true in production — it disables SSRF protection entirely.

devMode: true is shorthand for fetchSettings: new FetchSettings({ ssrfProtection: false, allowHttp: true, allowLocalhost: true, allowPrivateNetworks: true }). If you need finer control (e.g. allow loopback but keep HTTPS-only), construct a FetchSettings directly and pass it as fetchSettings:

import { FetchSettings } from "@authplane/sdk/core";

Without one of these, metadata discovery against an http:// issuer fails with MetadataFetchError: URL must use HTTPS.

Learn more

• User Guide — complete reference: scope enforcement, DPoP, token exchange, introspection & revocation, fetch settings, error handling, advanced configuration.
• @authplane/mcp — adapter for the MCP TypeScript SDK.
• @authplane/fastmcp — adapter for FastMCP.
• Root CHANGELOG — release history.
• SECURITY — vulnerability reporting.