@theaiinc/aegis-sdk

Client SDK for Aegis Identity Platform – add login, logout, and user/token access to any SPA (React, Vue, or vanilla JS).

Install

npm install @theaiinc/aegis-sdk oidc-client-ts

Quick start (vanilla or any framework)

import { AegisAuth } from '@theaiinc/aegis-sdk';

const auth = new AegisAuth({
  issuer: 'https://id.theaiinc.com',
  clientId: 'my-app',
  redirectUri: 'https://myapp.example.com/callback',
  postLogoutRedirectUri: 'https://myapp.example.com',
});

await auth.login();

const user = await auth.handleCallback();
const token = await auth.getToken();
await auth.logout();

By default, logout() ends the shared Aegis SSO session too, not just this app's own tokens -- so a user who signs out of one Aegis-backed app doesn't stay silently signed into every other one on the same browser. If that's not what you want (e.g. a suite of internal tools where signing out of one shouldn't sign out of the rest), opt out per call:

await auth.logout({ persistAegisSession: true });
// This app's own tokens are still revoked and cleared; the shared
// session is left alone so other apps keep working.

Open the hosted profile and security portal from an authenticated app:

auth.openAccountPortal();
// Opens https://id.theaiinc.com/account?client_id=my-app

Use auth.getAccountPortalUrl() when rendering your own link or button.

For device-ID onboarding, pass the optional email prefill hint to the Aegis device authorization URL:

const rid = auth.getDeviceRegistrationParam(user.email);
// rid=... (client_id::email::timestamp, Base64 encoded)

The hint expires after a short period and is only used to prefill the hosted email field; it is not an authentication credential.

React

import { AegisAuth, createAegisAuthContext } from '@theaiinc/aegis-sdk/react';

const auth = new AegisAuth({
  issuer: import.meta.env.VITE_OIDC_ISSUER,
  clientId: import.meta.env.VITE_OIDC_CLIENT_ID,
  redirectUri: `${window.location.origin}/callback`,
  postLogoutRedirectUri: window.location.origin,
});

const { AegisAuthProvider, useAegisAuth } = createAegisAuthContext(auth);

Requirements

• OAuth client registered in Aegis with matching redirect_uri and PKCE enabled for public SPAs
• CORS allows your app origin (Aegis allows origins matching client redirect URIs)

API

• AegisAuth(config) – create client
• login(extraQueryParams?) – redirect to Aegis login
• handleCallback(callbackUrl?) – call on callback page
• getUser() / getToken() / isAuthenticated()
• logout({ redirect?: boolean, persistAegisSession?: boolean }) – revokes tokens server-side, then clears local state and redirects (unless redirect: false); also ends the shared Aegis SSO session unless persistAegisSession: true
• getAccountPortalUrl({ clientId? }) / openAccountPortal({ clientId? })
• getDeviceRegistrationParam(email, timestamp?)
• onUserChange(callback) – subscribe to user changes
• getUserManager() – raw oidc-client-ts UserManager