Express

Use @authbound/server when your app already has an Express backend or you want full control over the verification route.

Install

pnpm add @authbound/server express cookie-parser

Environment

AUTHBOUND_SECRET_KEY=sk_test_...
AUTHBOUND_SESSION_SECRET=replace-with-a-random-32-byte-secret
AUTHBOUND_WEBHOOK_SECRET=whsec_...
AUTHBOUND_PUBLISHABLE_KEY=pk_test_...
PUBLIC_APP_URL=http://localhost:3000
AUTHBOUND_API_URL=https://api.authbound.io

The browser SDK sends the selected policy ID to the server route when it creates a verification.

Server

server.ts

import cookieParser from "cookie-parser";
import express from "express";
import { createAuthboundRouter, type AuthboundConfig } from "@authbound/server/express";

const app = express();

app.use(express.json({
  verify: (req, _res, buf) => {
    (req as express.Request & { rawBody?: Buffer }).rawBody = Buffer.from(buf);
  },
}));
app.use(cookieParser());

const authboundConfig: AuthboundConfig = {
  apiKey: process.env.AUTHBOUND_SECRET_KEY!,
  publishableKey: process.env.AUTHBOUND_PUBLISHABLE_KEY!,
  secret: process.env.AUTHBOUND_SESSION_SECRET!,
  webhookSecret: process.env.AUTHBOUND_WEBHOOK_SECRET!,
  allowedOrigins: [process.env.PUBLIC_APP_URL ?? "http://localhost:3000"],
  routes: {
    protected: [],
    verify: "/verify",
    callback: "/api/authbound/callback",
  },
};

app.use("/api/authbound", createAuthboundRouter(authboundConfig));

app.listen(3000);

The router provides:

Route	Purpose
`POST /api/authbound/verification`	Create a browser-safe verification handoff.
`POST /api/authbound/session`	Validate the pending same-origin binding, fetch the signed result server-side, and finalize the SDK-managed session after verified status.
`POST /api/authbound/callback`	Receive signed webhooks.
`GET /api/authbound/status`	Read the current SDK session cookie.
`DELETE /api/authbound`	Clear the SDK session cookie.

The browser can use @authbound/react, @authbound/vue, or direct fetches against POST /api/authbound/verification. SDK-managed sessions require navigator.locks. Same-origin tabs serialize verification creation and session finalization under a lock keyed by the resolved endpoint origin. If you need to support a browser or embedded webview without Web Locks, set sessionMode: "manual" and create the trusted session on your server.

If your backend only creates verifications and does not expose /api/authbound/session, set sessionMode: "manual" in the browser SDK and persist trusted state with your own webhook or result flow.

Set allowedOrigins to your public app origin when the API runs behind a proxy or container URL. Set trustProxy: true only when Forwarded or X-Forwarded-* headers come from infrastructure you control.

Add webhooks so your backend can persist verification outcomes without relying on the browser.

Start here

Identity verification

Credential issuance

AI

Install

Environment

Server

Next

​Install

​Environment

​Server

​Next

Install

Environment

Server

Next