@irfanwolfiz/smp-auth-sdk

Tiny SDK for the SMP Authentication Service. Two pieces:

• smp-auth.js — zero-dependency browser/isomorphic client (register, sign in, session, mint token, OAuth links).
• verify.js — server-side JWT verification against the service JWKS (needs jose).

The service does authentication only. Tokens are identity-only (sub + identifier + verification flags). Authorization — roles and permissions — lives in your app, keyed by sub.

Client (browser)

import { createAuthClient } from "@irfanwolfiz/smp-auth-sdk";

const auth = createAuthClient({ baseURL: "https://auth.example.com" });

await auth.signUp({ name: "Ada", email: "[email protected]", password: "s3cret…" });
await auth.signIn.email("[email protected]", "s3cret…");

const { user } = await auth.getSession();
const { token } = await auth.getToken();   // send this JWT to your API

// OAuth: link/button that starts the flow
location.href = auth.oauthStartUrl("google", "/welcome");

await auth.signOut();

signIn.username(u, p) and signIn.phone(phone, p) work the same when those methods are enabled in the admin panel.

One call → token directly

Skip the separate getToken() — sign in / sign up and get the JWT back at once:

const { user, token, expiresIn } = await auth.token.signIn.email(email, password);
// auth.token.signIn.username(u, p) · auth.token.signIn.phone(phone, p)
// auth.token.signUp({ name, email, password, username?, phoneNumber? })

Server (verify tokens)

import { createTokenVerifier } from "@irfanwolfiz/smp-auth-sdk/verify";

const verify = createTokenVerifier({ baseURL: "https://auth.example.com" });

// In your API middleware:
const token = req.headers.authorization?.replace("Bearer ", "");
const claims = await verify(token);        // throws if invalid/expired
// claims.sub is the stable user id → look up roles/permissions in YOUR db

JWKS is fetched once and cached; verification is local (no per-request call to the auth service).

Cross-origin

Cookies work same-origin out of the box. For a browser app on a different origin than the auth service, set TRUSTED_ORIGINS on the service to include your app's origin. The token path (getToken → verify) is origin-agnostic and the recommended integration for headless apps.