Web · SecureLink

pnpm add @securelink/web

Production defaults

Session vault: SecureWebStorage (AES-GCM + IndexedDB) — not plaintext localStorage
Prefer credentialDelivery: "cookie" so access/refresh tokens are HttpOnly (server must use credentialDelivery: "cookie" too)
Attestation off by default (no App Attest on web)

Anonymous (recommended: cookies)

import { createWebSecureLink } from "@securelink/web";
 
const client = createWebSecureLink({
  baseUrl: "https://api.example.com",
  authMode: "anonymous",
  credentialDelivery: "cookie", // tokens never touch JS storage
});
 
await client.initialize();
await client.request({ method: "GET", path: "/api/items" });

Bearer mode (encrypted IndexedDB) is the default when credentialDelivery is omitted.

Custom auth

Your app owns the login token. SecureLink only reads it via getAuthorization().

const client = createWebSecureLink({
  baseUrl: "https://api.example.com",
  authMode: "customAuth",
  authorization: {
    async getAuthorization() {
      return {
        authorization: `Bearer ${await getMyAppToken()}`,
        scheme: "custom",
      };
    },
  },
});