@totop/auth-sdk

Browser SDK for reviewed ToTop applications and games. It owns Authorization Code + PKCE, callback cleanup, token rotation, profile loading, protected fetches, and local/global logout separation.

import { ToTopAuth } from '@totop/auth-sdk'

await ToTopAuth.init('/totop.auth.json')
await ToTopAuth.login()

const user = ToTopAuth.getUser()
const response = await ToTopAuth.authorizedFetch('https://api.totop.ai/game-api/games/ID/saves')
await ToTopAuth.logout()

The reviewed totop.auth.json is public configuration and contains no secret. Access tokens stay in memory; rotating refresh tokens are limited to the current browser tab's sessionStorage for at most eight hours.

Run npx totop-auth verify in the integrating project before publishing.