SecureLink

What you provide

Client vs server — what SecureLink needs for anonymous vs customAuth.

SecureLink is an SDK. You plug in your environment. This page is the checklist.

Quick matrix

What Client SDK? Server SDK? Anonymous only Custom auth
Store (Redis / memory / your DB adapter) No Yes — plug into server Yes (anonymous tokens) Optional (rate limits); no SecureLink user DB
JWT / login validator No — only send your token Yes — authorizationValidator Not needed Required
Apple App Attest / Play Integrity Yes — getAttestationToken Yes — verifier Mobile if attestation on Mobile if attestation on
tokenHashSecret No Yes Required in production Required if anonymous also enabled
Your app database (todos, users, etc.) No No — not part of SecureLink Your app Your app

Redis is usable, not mandatory. Memory works for a single demo process. For multiple servers, pass RedisCredentialStore / RedisRateLimitStore (or any store implementing the interfaces).

Anonymous only (no own login)

Client

createWebSecureLink({ authMode: "anonymous", credentialDelivery: "cookie" });
// or RN / extension — see platform pages
await client.initialize();
await client.request({ method: "GET", path: "/api/..." });

Server must have

  • tokenHashSecret (from env)
  • Credential store (memory or Redis)
  • Rate-limit store (memory or Redis)
  • Apple/Google verifiers only if mobile attestation is enabled
  • No authorizationValidator

Custom auth (they already have login)

Client — send their token; they store JWT however they want:

createWebSecureLink({
  authMode: "customAuth",
  authorization: {
    async getAuthorization() {
      return { authorization: `Bearer ${theirJwt}`, scheme: "custom" };
    },
  },
});

Server must have

  • authorizationValidator — validate their JWT/session → { identity, valid }
  • Apple/Google if mobile attestation is on
  • tokenHashSecret if the server also allows anonymous; if authMode: "customAuth" only, focus on the validator + rate limits

SecureLink does not replace their auth provider.

Which SDK?

Concern Package
HttpOnly cookies / SecureWebStorage @securelink/web + server credentialDelivery: "cookie"
Keychain @securelink/react-native
Extension storage + installation proof @securelink/extension
tokenHashSecret, Redis adapters, JWT validator, proof verify @securelink/server

Never put tokenHashSecret or Apple/Google API secrets in a client package.

Demo vs production

The todo example uses allowInsecureDevMode and stub attestation so it runs locally.

Production: do not set allowInsecureDevMode. Wire real secret, store, validator (if customAuth), and platform verifiers (if mobile).

Next: Auth modes · Server setup