SecureLink

Auth modes

anonymous vs customAuth — when SecureLink creates identity, and when you bring your own.

SecureLink supports two modes. Switch with authMode on the client (and optionally restrict on the server).

For the full “what do I plug in?” checklist, see What you provide.

anonymous

SecureLink creates and manages an anonymous identity and credentials (access + refresh).

Use this for guests / pre-login users.

// Client
authMode: "anonymous"
 
// Server — no JWT validator needed
createSecureLinkServer({
  authMode: "anonymous", // or "both"
  tokenHashSecret: process.env.SECURELINK_TOKEN_SECRET!,
  // credentials / rateLimit stores as needed
});

customAuth

You already have authentication. SecureLink does not create an anonymous user.

You pass an authorization provider that returns your session / JWT / token. “Skip” means skip anonymous identity only.

// Client — send your token
authMode: "customAuth",
authorization: {
  async getAuthorization() {
    return { authorization: `Bearer ${myToken}`, scheme: "custom" };
  },
}
 
// Server — you validate that token
createSecureLinkServer({
  authMode: "customAuth", // or "both"
  authorizationValidator: {
    async validate(authorization) {
      const user = await verifyMyJwt(authorization.authorization);
      return { valid: Boolean(user), identity: { id: user.id, type: "user" } };
    },
  },
});

What does not get skipped

When attestation / installation proof is enabled:

Platform Still runs in customAuth
React Native App Attest / Play Integrity
Extension Installation request proof
Web Your auth material on each request

Server side

Mode authorizationValidator tokenHashSecret
Anonymous only Not needed Required in production
Custom auth Required If you also allow anonymous
Both Required Required