Server SDK · SecureLink

import {
  createSecureLinkServer,
  RedisCredentialStore,
  RedisRateLimitStore,
  formatSetCookie,
} from "@securelink/server";
 
const server = createSecureLinkServer({
  authMode: "both", // or "anonymous" | "customAuth"
  tokenHashSecret: process.env.SECURELINK_TOKEN_SECRET!, // required in production
  credentialDelivery: "bearer" | "cookie",
  attestation: {
    enabled: true,
    appAttestVerifier?,
    playIntegrityVerifier?,
    verifier?, // full custom ProofVerifier
  },
  authorizationValidator?, // required for customAuth in production
  credentials?: CredentialStore, // MemoryCredentialStore | RedisCredentialStore | yours
  installations?: InstallationStore,
  challenges?: ChallengeStore,
  rateLimit: {
    enabled: true,
    store?: RateLimitStore, // MemoryRateLimitStore | RedisRateLimitStore | yours
    user?,
    device?,
    installation?,
    ip?,
    endpoint?,
  },
  accessTokenTtlMs?,
  refreshTokenTtlMs?,
  cookie?,
  allowInsecureDevMode?, // NEVER true in production
});

Methods

Method	Purpose
`bootstrapAnonymous(req)`	Issue anonymous identity + tokens (optional `setCookies`)
`refreshAnonymous(req)`	Rotate access/refresh tokens
`registerInstallation(req)`	Store extension/device public key
`createAttestationChallenge(req)`	Single-use challenge for native proofs
`verify(req)`	Validate request → `SecurityContext`
`createMiddleware()`	Framework-agnostic helper

Stores

Interface	Memory default	Redis helper
`CredentialStore`	`MemoryCredentialStore`	`RedisCredentialStore`
`RateLimitStore`	`MemoryRateLimitStore`	`RedisRateLimitStore`
`InstallationStore`	`MemoryInstallationStore`	implement yourself
`ChallengeStore`	`MemoryChallengeStore`	implement yourself

Tokens are hashed at rest (tokenHashSecret). Your app DB (todos, users) is not part of this SDK.

Errors

ProtocolError codes include UNAUTHORIZED, FORBIDDEN, PROOF_REQUIRED, PROOF_INVALID, CREDENTIAL_EXPIRED, CREDENTIAL_INVALID, RATE_LIMITED, and protocol errors.