Quick start · SecureLink

This walkthrough uses anonymous mode on web, then shows the customAuth switch.

Before you ship: read What you provide (client vs server checklist).

1. Server

import { createSecureLinkServer } from "@securelink/server";
import { createServer } from "node:http";
 
const securelink = createSecureLinkServer({
  authMode: "both",
  tokenHashSecret: process.env.SECURELINK_TOKEN_SECRET ?? "dev-only-change-me",
  allowInsecureDevMode: true, // local demo only — remove in production
  attestation: { enabled: false }, // enable + verifiers on mobile/extension
  authorizationValidator: {
    // required when using customAuth in production
    async validate(authorization) {
      const raw = authorization.authorization ?? "";
      const token = raw.replace(/^Bearer\s+/i, "");
      if (!token.startsWith("demo-")) {
        return { valid: false, identity: { id: "unknown", type: "user" } };
      }
      return {
        valid: true,
        identity: { id: `user_${token.slice(5)}`, type: "user" },
      };
    },
  },
  rateLimit: {
    enabled: true,
    user: { max: 100, windowMs: 60_000 },
    ip: { max: 200, windowMs: 60_000 },
    endpoint: { max: 30, windowMs: 60_000 },
  },
});
 
createServer(async (req, res) => {
  // wire bootstrap + verify() — see Examples → Protected API
}).listen(8787);

Runnable sample: examples/todo/server on GitHub.

2. Web client (anonymous)

import { createWebSecureLink } from "@securelink/web";
 
const client = createWebSecureLink({
  baseUrl: "http://localhost:8787",
  authMode: "anonymous",
  // production tip: credentialDelivery: "cookie" (match server)
});
 
await client.initialize();
const res = await client.request({ method: "GET", path: "/api/hello" });
console.log(res.data);

SecureLink creates an anonymous identity and credentials for you.
No JWT validator needed on the server for this path.

3. Switch to your own auth

When you already have login, use customAuth. Anonymous identity is skipped.

const client = createWebSecureLink({
  baseUrl: "http://localhost:8787",
  authMode: "customAuth",
  authorization: {
    async getAuthorization() {
      const token = await yourApp.getSessionToken();
      return { authorization: `Bearer ${token}`, scheme: "custom" };
    },
    async onUnauthorized() {
      await yourApp.reLogin();
    },
  },
});

You own users and login. On the server, implement authorizationValidator so SecureLink can trust that token.

Full examples: Todo apps on GitHub · Todo example apps

Next: Web · Server · What you provide