@axowl/sdk-core

Shared core for the Axowl SDK — API client, token management, session handling, and TypeScript types.

You probably want @axowl/sdk (React) or @axowl/sdk-backend (Node.js) instead. This package is the internal engine used by both.

Install

npm install @axowl/sdk-core

Usage

import { AxowlClient } from '@axowl/sdk-core';

const client = new AxowlClient({
  orgSlug: 'my-org',
  appKey: 'ak_live_xxxxx',
});

// Magic link login
await client.sendMagicLink({ email: '[email protected]' });

// Social login
const auth = await client.loginWithSocial({
  provider: 'google',
  idToken: '...',
});

// Get current user
const user = await client.getUser();

// Check permission
const allowed = await client.can('dashboard.view');

// Logout
await client.logout();

Token Utilities

import { decodeJwt, isTokenExpired, TokenManager } from '@axowl/sdk-core';

// Decode without verification (client-side)
const payload = decodeJwt(token);
// { sub, email, org_slug, permissions, exp, ... }

// Check expiry
if (isTokenExpired(token)) {
  // token is expired
}

// Token manager with storage
const tokens = new TokenManager('localStorage');
tokens.setTokens(accessToken, refreshToken);
tokens.isAuthenticated(); // true if token exists and not expired

Permission Matching

import { hasPermission, matchScope } from '@axowl/sdk-core';

// Exact match
matchScope('sap.fi.document.post', 'sap.fi.document.post'); // true

// Wildcard
matchScope('sap.fi.*', 'sap.fi.document.post'); // true
matchScope('sap.*', 'sap.fi.document.post');     // true

// Check against user's permission list
const permissions = ['dashboard.*', 'report.view'];
hasPermission(permissions, 'dashboard.edit');  // true (wildcard)
hasPermission(permissions, 'report.view');     // true (exact)
hasPermission(permissions, 'report.delete');   // false

API Reference

AxowlClient

| Method | Description | |---|---| | getLoginMethods() | Get available login methods + branding | | sendMagicLink(request) | Send magic link email | | verifyMagicLink(token, email) | Verify magic link and get JWT | | loginWithSocial(request) | Login with Google/Line | | loginWithFederated(request) | Login via OIDC federation | | loginWithPasskey(email, responseJson) | Login with FIDO2 passkey | | registerWithPasskey(email, credential) | Register with passkey | | getUser() | Get current authenticated user | | logout() | End current session | | revokeAllSessions() | Revoke all sessions | | refreshSession() | Refresh access token | | checkPermission(scope) | Get signed permission permit | | can(scope) | Quick boolean permission check |

Configuration

interface AxowlConfig {
  orgSlug: string;          // Your organization slug
  appKey: string;           // Application key (ak_live_xxx)
  baseUrl?: string;         // API base URL (default: https://auth.axowl.com)
  tokenStorage?: 'localStorage' | 'sessionStorage' | 'memory';
  autoRefresh?: boolean;    // Auto-refresh tokens (default: true)
  refreshThresholdSeconds?: number; // Refresh before expiry (default: 60)
}

License

MIT