SDKs

Authbound’s public SDK packages are TypeScript-first and split by runtime. Server packages keep secret keys off the browser. UI packages handle wallet QR codes, deep links, status, and basic flow state.

Packages

Package	Runtime	Use it for
`@authbound/nextjs`	Next.js	App Router verification routes, middleware, React components, hooks, manual station BFF route helpers, and styles.
`@authbound/server`	Node servers	REST API client, verification creation, issuance, webhook signatures, signed results, Express, and Hono.
`@authbound/react`	Browser	React provider, hooks, QR code, deep link button, verification wall.
`@authbound/vue`	Browser	Vue plugin, composables, QR code, deep link button, verification wall.
`@authbound/nuxt`	Nuxt	Nuxt module, auto-imports, verification and station BFF routes (auto-registered), route middleware.
`@authbound/core`	Browser and Node	Low-level client, branded types, status subscriptions, link builders, policy types.

All packages require Node.js 18 or newer for Node-based builds and tooling.

Package	Supported framework versions
`@authbound/server`	Express 4.18+, Hono 4+, or Next.js 14 through 16. Framework peers are optional.
`@authbound/react`	React and React DOM 18.3 through 19.x.
`@authbound/vue`	Vue 3.5.34 through 3.x.
`@authbound/nextjs`	Next.js 14 through 16 and React 18.3 through 19.x.
`@authbound/nuxt`	Nuxt 4 and Vue 3.5.34 through 3.x.

Start by stack

Stack	Guide
Next.js App Router	Verify with Next.js
React SPA	Verify with React
Vue	Verify with Vue
Nuxt	Verify with Nuxt
Express	Verify with Express
Hono	Verify with Hono
Node issuance	Issue with Node.js

Server client

Use AuthboundClient for server-side API calls.

import { AuthboundClient } from "@authbound/server";

const authbound = new AuthboundClient({
  apiKey: process.env.AUTHBOUND_SECRET_KEY!,
});

Verification policies

Use authbound.policies to create project-scoped policies, then pass the returned ID to verification creation. Policy creation requires @authbound/server 0.4.0 or later.

const policy = await authbound.policies.create({
  name: "Age gate",
  attestationType: "pid",
  ecosystem: "eudi",
  format: "dc+sd-jwt",
  requestedClaims: [{ claim: "age_over_18", values: [true] }],
  idempotencyKey: "policy:age-gate:v1",
});

const verification = await authbound.verifications.create({
  policyId: policy.id,
  customerUserRef: "user_123",
  idempotencyKey: "verify:user_123",
});

Each selected claim is requested, required, and returned. Use { claim, values } for exact typed requirements, such as { claim: "age_over_18", values: [true] }. Values can be strings, booleans, or safe integers; they are not coerced. Eligibility claims accept only [true]; an age gate can request an age proof without requesting a birth date. Claims must be unique after alias resolution. Scalar equality constraints are not supported for EUDI PID nationality, whose result is an array. Choose exactly one target: attestationType, credentialDefinitionId, or vct. Built-in attestations also require ecosystem and format; custom definition and VCT targets support dc+sd-jwt. Policy creation requires policies:write; list and get require policies:read. SDK 0.4.0 rejects creation-time returnAttrs (REST return_attrs). The returned policy.returnAttrs describes the output keys, including canonical aliases such as birth_date; it is read-only metadata. Existing saved policies retain their stored selections. Select only the claims your application needs. Matching returned identity details to an existing customer record remains your application’s responsibility.

Policy presets

Use PolicyPresets for starter policies with concrete, versioned IDs.

import { PolicyPresets, getPresetPolicyId } from "@authbound/core";

const ageGatePolicyId = PolicyPresets.AGE_GATE_18;
// "pol_age_over_18_authbound_v1"

const identityPolicyId = getPresetPolicyId("identity_basic_eudi");
// "pol_identity_basic_eudi_v1"

Authbound and EUDI presets are split so you can choose the credential ecosystem intentionally:

Preset	Policy ID
`PolicyPresets.AGE_GATE_18`	`pol_age_over_18_authbound_v1`
`PolicyPresets.AGE_GATE_18_EUDI`	`pol_age_over_18_eudi_v1`
`PolicyPresets.IDENTITY_BASIC`	`pol_identity_basic_authbound_v1`
`PolicyPresets.IDENTITY_BASIC_EUDI`	`pol_identity_basic_eudi_v1`
`PolicyPresets.KYC_BASIC`	`pol_kyc_basic_authbound_v1`
`PolicyPresets.KYC_BASIC_EUDI`	`pol_kyc_basic_eudi_v1`
`PolicyPresets.PENSION`	`pol_authbound_pension_v1`

For setup UIs, call fetchPresetRegistry("https://api.authbound.io") to load cacheable public preset metadata from /v1/presets.

React UI

Use AuthboundProvider once near the app root and render VerificationWall where the user should verify. For Vite React apps, use import.meta.env with the VITE_ prefix. Next.js apps should use @authbound/nextjs/client and NEXT_PUBLIC_* instead. See Verify with Next.js.

import {
  asPolicyId,
  AuthboundProvider,
  VerificationWall,
} from "@authbound/react";

const policyId = asPolicyId(import.meta.env.VITE_AUTHBOUND_POLICY_ID!);

export function Verify() {
  return (
    <AuthboundProvider publishableKey={import.meta.env.VITE_AUTHBOUND_PK!}>
      <VerificationWall policyId={policyId} />
    </AuthboundProvider>
  );
}

Station BFF routes

Station access depends on organization feature enablement. SDK exports alone do not enable Stations in the dashboard. Nuxt auto-registers station entry, display, operator, and disclosure routes under /api/authbound/stations/*. Next.js requires manual App Router route files; import the createStation*Route helpers from @authbound/nextjs/server. See Verify with Next.js.

API origin

All packages should point to:

https://api.authbound.io

Use overrides only for local development or test harnesses.

Status auth

Browser SDKs use the publishable key and the short-lived clientToken returned by a verification create call. Secret keys stay on your server. SDK-managed same-origin sessions can finalize browser route UX after a verified status. The session route checks the pending browser binding, uses the secret key to fetch the signed result, and only then sets the SDK cookie. Continue to use webhooks or signed result lookups for durable backend reconciliation.

Browser session coordination

The default SDK-managed session mode requires the Web Locks API. Same-origin tabs serialize verification creation and session finalization under a lock keyed by the resolved endpoint origin. If navigator.locks is unavailable or a lock cannot be acquired, the SDK fails with session_coordination_unsupported instead of risking a session race. Use manual session mode when you support a browser or embedded webview without Web Locks, or when several origins share a parent-domain session cookie. In manual mode, your server owns session creation and cross-origin coordination. Calls to start() while a verification start is already pending share the same promise only when their options match. Different options fail with verification_invalid_state. Keep metadata and provider objects stable when more than one component can start the same flow.

Time limits

Verifications and their clientToken expire after 15 minutes by default. SDK-managed sessions set a __authbound_pending cookie when a verification is created. This cookie is capped at 10 minutes, regardless of your session cookie maxAge. Session finalization requires the pending cookie to still be present. Long wallet flows can fail with VERIFICATION_BINDING_REQUIRED if the user takes longer than 10 minutes before the browser finalizes the session.

AuthboundClient API surface

AuthboundClient from @authbound/server exposes thin Gateway API connectors:

Namespace	Methods	Use for
`verifications`	`create`, `get`, `list`, `cancel`, `getStatus`, `getResult`	Verification lifecycle and signed results.
`policies`	`create`, `list`, `get`, `archive`	Project-scoped verification policies.
`issuer.credentialDefinitions`	`list`, `get`, `create`, `createDraft`, `update`, `publish`, `archive`	Credential definition lifecycle.
`openId4Vc.issuance`	`createOffer`, `list`, `get`, `update`, `cancel`, `revoke`	OpenID4VCI issuance sessions.
`stations`	`create`, `list`, `get`, `pause`, `resume`, `close`, `rotateDisplayToken`, `createOperatorGrant`, `revokeOperatorGrant`, `listVerifications`, `getVerification`, `listEvents`, `getDisplay`, `getVerificationDisclosure`	Station entry and operator flows.
`webhooks`	`verifySignature`	Webhook signature verification. For the failure reason, use the standalone `verifyWebhookSignatureDetailed` export.

Use verifications.getStatus(verificationId, { clientToken, publishableKey }) when you need server-side status checks with browser credentials. Use verifications.getResult(verificationId) for signed, high-trust reconciliation. See Issue credentials for issuance guides and Verify overview for verification statuses and failure codes.

Status subscriptions

Framework packages subscribe to verification progress automatically. Custom UI can call client.subscribeToStatus on the client returned by createClient from @authbound/core. The SDK uses SSE at /v1/verifications/{id}/events/sse, with polling at /v1/verifications/{id}/status as fallback. Both use Authorization: Bearer <clientToken> and X-Authbound-Publishable-Key. The SSE client uses fetch so credentials stay in headers. Pass { expiresAt: verification.expiresAt } as the fourth argument to client.subscribeToStatus(verification.verificationId, verification.clientToken, onEvent, options). Polling stops at terminal status or that deadline; without an expiry, the default polling ceiling is five minutes. Polling intervals start at one second and increase to thirty seconds. A 503 realtime_unavailable response switches to polling when fallback is enabled. A local timeout is not a successful verification. Offer a restart and reconcile the result on your server.

Start here

Identity verification

Credential issuance

AI

Packages

Start by stack

Server client

Verification policies

Policy presets

React UI

Station BFF routes

API origin

Status auth

Browser session coordination

Time limits

AuthboundClient API surface

Status subscriptions

​Packages

​Start by stack

​Server client

​Verification policies

​Policy presets

​React UI

​Station BFF routes

​API origin

​Status auth

​Browser session coordination

​Time limits

​AuthboundClient API surface

​Status subscriptions

Packages

Start by stack

Server client

Verification policies

Policy presets

React UI

Station BFF routes

API origin

Status auth

Browser session coordination

Time limits

AuthboundClient API surface

Status subscriptions