AuthCore SDK

JavaScript SDK for AuthCore — self-hosted authentication.

Install

npm install authcore-sdk

Quick Start

import AuthCore from 'authcore-sdk';

const auth = new AuthCore({
  url: 'https://auth.yourdomain.com',
  projectKey: 'proj_xxxxxxxxxxxxxxxx',
  persist: true, // optional — survive page reloads
});

// Email OTP
await auth.sendOtp({ email: '[email protected]' });
const { user } = await auth.verifyOtp({ email: '[email protected]', code: '123456' });

// Phone OTP
await auth.sendOtp({ phone: '+2348012345678' });
const { user } = await auth.verifyOtp({ phone: '+2348012345678', code: '123456' });

// Password login
await auth.signIn({ email: '[email protected]', password: 's3cur3' });

// Listen for auth state changes
auth.onAuthStateChange((event, session) => {
  if (event === 'SIGNED_IN') console.log('Signed in:', session?.user);
  if (event === 'SIGNED_OUT') console.log('Signed out');
});

// Authenticated API calls
const res = await auth.fetch('https://api.yourapp.com/me');

// Sign out
await auth.signOut();

Security

• Token storage: When persist: true, tokens are stored in sessionStorage (cleared on tab close). For sensitive applications, implement custom storage or use memory-only mode (persist: false).
• Transport: All API calls use HTTPS POST — tokens never appear in URLs.
• Refresh: Refresh tokens are rotated on every use. Reuse of an old token revokes the entire session family.
• No dependencies: Zero runtime dependencies — zero supply-chain risk.

Platforms

Works in browsers, React Native, and Node.js (ESM). TypeScript types included.

License

MIT