@glinr/theauth-express

npm · Source · Docs · All packages

Express adapter for theAuth.

Part of theAuth, open-source auth for AI agents and humans. Docs: docs.theauth.dev.

Install

pnpm add @glinr/theauth @glinr/theauth-express

Usage

import express from 'express';
import { createTheAuth } from '@glinr/theauth';
import { theAuthExpress } from '@glinr/theauth-express';

const app = express();
app.use(express.json());
app.use(express.urlencoded({ extended: true }));

const theauth = createTheAuth({
  database: { provider: 'sqlite', url: 'theauth.db' },
});

// Mount all TheAuth routes at /auth
app.use('/auth', theAuthExpress(theauth, { authenticate }));

app.listen(3000);

This mounts the full theAuth REST API: agent CRUD, authorization, delegations, audit logs, and dashboard stats.

With MCP OAuth 2.1

import { createMcpModule } from '@glinr/theauth/mcp';
import { theAuthExpress } from '@glinr/theauth-express';

const mcp = createMcpModule({
  issuer: 'https://your-app.com',
  // ...
});

app.use('/auth', theAuthExpress(theauth, { mcp, authenticate }));

When mcp is provided, the OAuth 2.1 endpoints are enabled:

• GET /.well-known/oauth-authorization-server
• GET /.well-known/oauth-protected-resource
• POST /mcp/register
• GET /mcp/authorize
• POST /mcp/token

Management routes and client IP

With the default session guard, a signed-in user only acts on their own agents, delegations and audit rows. A custom authenticate resolver is a trust decision and sees everything.

The adapter does not read forwarded headers for the client IP. Behind a proxy, set trustedProxy with trustedProxyCount or trustedHeader, or ipAllowlist constraints cannot match.

app.use("/api/theauth", theAuthExpress(theauth, { authenticate, trustedProxy: { trustedProxyCount: 1 } }));

On Cloudflare use trustedHeader: "cf-connecting-ip". Only trust a header your edge overwrites. Without trustedProxy the adapter uses req.ip, which is the socket peer unless your server framework is configured to trust the proxy.

API surface

theAuthExpress(theauth, options?) returns an Express Router. Pass it to app.use() with your chosen prefix.

| Option | Type | Description | |--------|------|-------------| | mcp | McpAuthModule | Enables MCP OAuth 2.1 endpoints |

For full docs on agent identity, permissions, delegation, and audit, see the main @glinr/theauth package.

Links

• Documentation
• GitHub

License

MIT

Learn more

• express adapter guide
• All adapters
• All packages
• GitHub Discussions for questions
• Report a security issue