Use @authbound/react for the browser UI. Your React app still needs a server route to create verifications with your secret key.

Install

Environment

Copy YOUR_POLICY_ID from the Authbound dashboard.

Server route

Mount the SDK server router on the same origin as your React app. It creates verifications, stores the pending browser binding cookie, and finalizes the HttpOnly session after the browser observes a verified status by fetching the signed result with your secret key.
server.ts
The router provides POST /api/authbound/verification and POST /api/authbound/session, which are the default endpoints used by AuthboundProvider. The session route validates the pending same-origin browser binding before it sets the SDK cookie. SDK-managed sessions require navigator.locks. Same-origin tabs serialize verification creation and session finalization under a lock keyed by the resolved endpoint origin. If you need to support a browser or embedded webview without Web Locks, use sessionMode="manual" and create the trusted session on your server. Set allowedOrigins to your public app origin when the API runs behind a proxy or container URL. Set trustProxy: true only when Forwarded or X-Forwarded-* headers come from infrastructure you control.
If your backend only creates verifications and does not expose /api/authbound/session, set sessionMode="manual" on AuthboundProvider and persist trusted state with your own webhook or result flow.
For Vite local development, proxy /api to the backend:
vite.config.ts

Provider

src/main.tsx

Verification page

src/App.tsx

Next

For production, use the SDK session cookie for same-origin route UX and store the trusted result from webhooks or authbound.verifications.getResult() before granting durable access.