@authbound/react for the browser UI. Your React app still needs a server route to create verifications with your secret key.
Install
Environment
YOUR_POLICY_ID from the Authbound dashboard.
Server route
Mount the SDK server router on the same origin as your React app. It creates verifications, stores the pending browser binding cookie, and finalizes the HttpOnly session after the browser observes a verified status by fetching the signed result with your secret key.server.ts
POST /api/authbound/verification and POST /api/authbound/session, which are the default endpoints used by AuthboundProvider. The session route validates the pending same-origin browser binding before it sets the SDK cookie.
SDK-managed sessions require navigator.locks. Same-origin tabs serialize verification creation and session finalization under a lock keyed by the resolved endpoint origin. If you need to support a browser or embedded webview without Web Locks, use sessionMode="manual" and create the trusted session on your server.
Set allowedOrigins to your public app origin when the API runs behind a proxy or container URL. Set trustProxy: true only when Forwarded or X-Forwarded-* headers come from infrastructure you control.
If your backend only creates verifications and does not expose
/api/authbound/session, set sessionMode="manual" on AuthboundProvider and persist trusted state with your own webhook or result flow./api to the backend:
vite.config.ts
Provider
src/main.tsx
Verification page
src/App.tsx
Next
For production, use the SDK session cookie for same-origin route UX and store the trusted result from webhooks orauthbound.verifications.getResult() before granting durable access.