SDKs

Three lines of code.
Seven languages.

Install. Initialize. Protect routes. JWT validation, permission checks, session management -- all handled by the SDK.

Available on Free and above. See pricing

Start free Read the docs

The contract

Three lines. Then the request path is protected.

Every SDK does the same three things in your language's idioms: install the package, initialize a client against your tenant, and wrap a route with auth.require('read:users'). Underneath, the middleware reads the Authorization: Bearer header, validates the JWT locally, and checks the requested permission against the token's claims — returning 403 before your handler ever runs. The result is the same contract in seven languages, not seven different security models to reason about.

  • Install: one package manager command — npm, go get, pip, Maven, dotnet, Composer, or gem.
  • Initialize: point a client at your tenant once; the SDK owns key fetch, caching and rotation from there.
  • Protect: a route-level guard, not an if-ladder hand-rolled in every handler waiting to be forgotten.
Express, Fastify, Hapi, Koa
npm install @authfi/node
const auth = authfi({ tenant: 'acme' });
app.use(auth.middleware());
app.get('/api/users', auth.require('read:users'), handler);

Same shape in every language: install, initialize, guard the route.

What the SDK handles

The auth code you didn't write — and don't maintain.

These are the six surfaces that quietly accrete bugs when teams roll their own: signature checks, permission gates, refresh-token rotation, identity hydration, MFA assertions, and machine-to-machine tokens. The SDK ships them once, audited, typed, and identical across languages — so the same review covers your Node gateway and your Go worker.

JWT validation

RS256 signature verification, expiry checks, issuer validation. Keys fetched and cached from JWKS endpoint.

Permission checks

auth.require("read:users") -- middleware returns 403 if the JWT lacks the permission. No if-statements.

Session management

Automatic refresh token rotation. Token family detection. Session revocation via API.

User context

auth.user() returns the full identity -- email, roles, groups, permissions, metadata. Typed in every language.

MFA verification

Check mfa_verified claim. Require step-up auth for sensitive operations.

Workload identity

Service-to-service auth. Machine tokens with scoped permissions. No user context needed.

access-token.jwt (decoded)
{
  "iss": "https://acme.authfi.io",
  "sub": "usr_a1b2c3",
  "aud": "api://acme",
  "exp": 1782034762,
  "permissions": ["read:users"],
  "mfa_verified": true
}
— alg: RS256 · verified against /.well-known/jwks.json

The SDK verifies iss, aud, exp and signature locally; no round-trip per request.

Token validation

Verified on your server. Not on a phone call to ours.

Tokens are RFC 7519 JWTs signed RS256. On the first request the SDK fetches the issuer's public keys from the JWKS endpoint and caches them; every subsequent token is verified in process — signature, expiry and issuer — with no network hop per request. Because validation uses a public key, no shared secret ever ships inside your binary, and a compromised service can't forge tokens for another.

  • The problem it removes: the latency and outage coupling of phoning home to introspect every request.
  • Key rotation: the SDK re-fetches JWKS on an unknown kid, so the IdP can rotate signing keys with zero redeploys.
  • Permission gate: auth.require("read:users") reads the permissions claim and returns 403 — no extra call.
Node.js npm install @authfi/node
Go go get github.com/authfi/sdk-go
Python pip install authfi
C# dotnet add package AuthFI.AspNetCore
PHP composer require authfi/authfi-php
Ruby gem install authfi

Beyond the request path

An SDK for runtime. An API for everything else.

The SDK guards live traffic; the Management API is how you administer the tenant — users, groups, permissions, connections — as plain REST. Anything you can click in the console is a documented HTTP call, which means identity stops being console-only state and becomes identity-as-code: the same definitions live in version control, ship through CI, and review like the rest of your infrastructure.

  • REST under everything: the SDK's convenience methods wrap the same endpoints you can call directly with curl.
  • Workload identity: machine tokens with scoped permissions let a CI job call the Management API with least privilege — no user in the loop.
  • The payoff: roles, groups and connections become a reviewable diff, not a click someone made once and can't reconstruct.
identity.tf 
resource "authfi_role" "support" {
  name        = "support-agent"
  permissions = ["read:users", "read:tickets"]
}

resource "authfi_group" "support" {
  name  = "Support"
  roles = [authfi_role.support.id]
}

Declarative config maps to the same Management API the SDKs call — identity reviewed like infra.

Standards, not lock-in

Named RFCs on the wire. Nothing bespoke to learn.

The SDK is sugar over published standards — it does not invent its own auth protocol. Every token is an OAuth/OIDC artifact, every signature a JWT verified against JWKS, every lifecycle event a SCIM call. If you ever swap the SDK for a raw HTTP client, the contract underneath is the same one a security review already knows how to assess.

OAuth 2.1 / OIDC

Authorization-code flow with PKCE; ID and access tokens minted at the token endpoint. The SDK is a resource-server consumer of bearer tokens.

JWT + JWKS

Tokens are RFC 7519 JWTs signed RS256. The SDK validates against the JWKS the issuer publishes — no shared secret ships in your binary.

SCIM 2.0

User and group lifecycle over the Management API: provision, update, deactivate — the same model your IdP already speaks.

LDAP / REST

The SDK talks to AuthFI over plain REST — every call a documented HTTPS request underneath. LDAP lives one layer up: AuthFI binds against your directory to source identities into the IdP, not on the per-request path.

Languages
Node · Go · Python · Java · C# · PHP · Ruby
Token verify
Local, JWKS-cached
Plan
Free tier
Transport
REST (HTTPS)

Pick your language

Seven runtimes. One mental model.

Whatever your stack is built on, the SDK meets it in its own framework idioms — Express middleware, Go handlers, Flask decorators, Spring annotations, ASP.NET attributes, Laravel middleware, Sinatra blocks. The install line and the guard call change; the security model never does.

Get started

Ready to get started?

Free for 5,000 monthly active users. No credit card required.

Start free Read the docs