Next.js
The App Router, with route handlers, middleware and currentUser(). Three files.
Documentation
Every web quickstart below is a complete application you can run, not a snippet, and the iOS and Android SDKs each come with an example app. Start from the one that matches your framework.
Quickstarts
SvelteKit
Request handlers and a handle hook, for Svelte 4 and 5. Three files.
Nuxt
A plugin and composables over Nuxt's h3 handlers. Three files.
SolidStart
Signal-based session state, with SolidStart handlers and middleware. Three files.
htmx
Server-only, in one file. HX-Redirect-aware sign-in, and guards that answer fragments correctly.
Alpine.js
No build step at all: two script tags and a page.
Alpine AJAX
Server-only guards that answer a target-addressed 401, because Alpine AJAX cannot be told to navigate.
iOS
A Swift package with no dependencies: sign-in through the system browser, tokens in the Keychain, and refresh serialised across an app and its extensions. Built, and not yet published.
Android
A Kotlin library for Android 8.0 and later: sign-in through a Custom Tab, tokens sealed by the Keystore, and refresh serialised across the app's processes. Built, and not yet published.
Guides
- Multi-tenancy
- How tenants are isolated, and why the isolation is in the database rather than in a filter.
- Audiences and scopes
- Audience-scoped tokens, the scope registry, and what a narrowed grant actually grants.
- Passkeys
- WebAuthn with discoverable credentials, and what residency does and does not promise.
- MFA
- TOTP, recovery codes, per-tenant policy, and administrative reset.
- Dynamic registration
- RFC 7591 self-registration, its quota, and what it refuses.
- Webhooks
- Delivery, retries, the dead-letter queue, and replay.
- Outbound mail
- Per-tenant relays, why mail is per tenant, and how to tell when nothing will be delivered.
- Key management
- Per-tenant encryption keys, rotation, and the KMS seam.
- Rate limiting
- What is bucketed, by what identity, and what happens on a trip.
- Audit export
- The hash chain, the seal, and verifying an export you were given.
- Deploying
- Configuration, health endpoints, and what a deployment needs before it serves traffic.
- Backup and restore
- What has to be backed up together, and why a database dump alone is not enough.
SDKs
Thirteen packages on npm under @proteles: the framework-agnostic
core, a backend-for-frontend so tokens never reach the browser, bindings for
React, Next, Vue, Svelte, Solid, htmx, Alpine and Alpine AJAX, middleware for
Express and Fastify, and a typed Management API client.
Native SDKs for iOS, in Swift, and for Android, in Kotlin, are built and not yet published. Their quickstarts are above.