@sneekin/auth

Remote Sneek Auth client. Apps no longer generate OTPs, manage refresh-token rotation, rate-limit identifiers, or verify local JWTs. They call Sneek with their SNEEK_API_KEY; Sneek owns auth challenges, anti-abuse controls, session introspection, and billing.

Server Usage

import { SneekAuthClient, SneekAuthGuard, SneekAuthModule } from '@sneekin/auth';

@Module({
    imports: [
        SneekAuthModule.forRoot({
            apiUrl: process.env.SNEEK_API_URL ?? 'https://sneek.in',
            apiKey: process.env.SNEEK_API_KEY!,
        }),
    ],
})
export class AuthModule {}

Expose app login routes as thin forwards:

await sneekAuth.requestOtp({ identifier });
await sneekAuth.verifyOtp({ requestId, code });

Protect app routes with the shared guard:

@UseGuards(SneekAuthGuard)
@Get('me')
me(@Req() req) {
    return req.user;
}

The guard accepts Authorization: Bearer <sneek-access-token>, X-Sneek-Access-Token, or the access_token cookie. It introspects the session against Sneek using the app API key and attaches the standard user object to request.user.

API Contract

• POST /api/v1/auth/otp/request -> { requestId, channels, expiresInSeconds }
• POST /api/oauth/token with grant_type=urn:sneek:params:oauth:grant-type:otp -> OAuth token response + user
• POST /api/oauth/token with grant_type=refresh_token -> rotates tokens
• POST /api/oauth/introspect -> RFC-7662-shaped { active, sub?, aud?, exp?, user? }
• POST /api/oauth/revoke -> RFC-7009-style session revocation

All endpoints require the app's SNEEK_API_KEY; user access tokens are never used as app credentials.