@yappr/server-node

Mint short-lived Yappr end-user auth tokens from your backend. Runs on Node 18+, Bun, and edge runtimes (pure WebCrypto, zero dependencies).

Why

Your publishable key (pk_live_…) identifies your tenant and is safe to ship in the browser. To prove who an end-user is, your server signs a short-lived token with your secret (jwt_secret) — the secret never leaves your backend, so the browser can't impersonate anyone.

Install

npm install @yappr/server-node

Mint a token (server-side)

import { mintToken } from "@yappr/server-node";

// In your authenticated API route, for the currently logged-in user:
const token = await mintToken(
  { tenantId: "t_xxx", userId: user.id, displayName: user.name },
  process.env.YAPPR_JWT_SECRET!,   // your tenant's jwt_secret — server-only
  { expiresInSeconds: 3600 },
);
// Return `token` to the browser; pass it to createClient({ key: pk_live, token }).

tenantId and your pk_live / jwt_secret are issued when your Yappr tenant is provisioned. Keep jwt_secret secret (env var / secrets manager) — treat it like a password.

API

• mintToken(claims, secret, opts?) → Promise<string> — claims: { tenantId, userId, displayName? }; opts: { expiresInSeconds?: number (default 3600) }.
• verifyToken(token, secret, opts?) → Promise<VerifiedToken> — usually only the Yappr server calls this; exposed for testing.