@huatek/ghostkey-client

Browser SDK for GhostKey Auth.

This package wraps the WebAuthn browser ceremony with @simplewebauthn/browser and talks to your app-owned GhostKey API routes. Use it directly in vanilla browser apps or through @huatek/ghostkey-react.

Install

npm install @huatek/ghostkey-client

Usage

import { createGhostKeyClient } from "@huatek/ghostkey-client";

const ghostkey = createGhostKeyClient({
  apiBaseUrl: "/api/auth",
  getRequestHeaders: () => ({
    "x-ghostkey-city": "Sao Paulo",
    "x-ghostkey-country": "BR"
  })
});

await ghostkey.registerDevice({ userId: "gku_123", name: "Chrome Windows" });
await ghostkey.login({
  userId: "gku_123",
  email: "[email protected]",
  registerIfNoPasskey: true
});

Expected backend routes

• POST /registration/options
• POST /registration/complete
• POST /registration/fallback
• POST /authentication/options
• POST /login
• POST /logout
• POST /refresh
• POST /magic-link/verify
• POST /step-up/options
• POST /step-up/verify
• POST /policy/evaluate
• POST /bot/challenge
• POST /bot/verify
• GET /sessions/graph
• POST /delegation/create
• POST /delegation/accept
• GET /devices
• GET /security/overview

These paths are relative to apiBaseUrl.

Notes

• This package must run in a browser context.
• It never receives or stores private keys.
• Passkey UI is controlled by the browser or platform authenticator.
• If login finds no passkey, login({ registerIfNoPasskey: true }) registers one before retrying login.
• If passkey registration fails, the client can request the magic-link fallback through /registration/fallback.
• Anti-bot, session graph and delegation helpers are available through createBotChallenge(), verifyBotChallenge(), getSessionGraph(), delegateAccess() and acceptDelegatedAccess().