Drop-in authentication for modern web apps. JWT with silent rotation, OAuth2, and HTTP-only cookie sessions. Wire it once, never think about it again.
Access token TTL
Pre-expiry rotation window
Session persistence
OAuth providers, one toggle
Add the SDK to your project. React, plain frontend, and Node packages ship from the same protocol core.
Wrap your app once. The provider handles the token lifecycle, cookie sessions, and OAuth redirects behind the scenes.
user, login, logout. That is the entire integration surface. Everything else is handled for you, silently.
$ npm install @auther-sdk/react added 1 package in 1.2s
import { AutherProvider } from '@auther-sdk/react';
export default function App({ children }) {
return (
<AutherProvider
clientId={process.env.NEXT_PUBLIC_AUTHER_KEY}
endpoint="https://your-api.com/api/v1"
>
{children}
</AutherProvider>
);
}import { useAuther } from '@auther-sdk/react';
export function Profile() {
const { user, login, logout } = useAuther();
if (!user) {
return <button onClick={login}>Sign in</button>;
}
return <p>Welcome back, {user.email}</p>;
}Every request is verified server-side in real time. No cached auth state, no stale sessions. Revocations propagate instantly.
Access tokens live 15 minutes and rotate 60 seconds before expiry. Your users never see a login wall mid-session.
Google, GitHub, and Meta enabled from the dashboard. The SDK picks up provider config automatically, zero extra code.
Tokens never touch localStorage or JavaScript. HTTP-only, SameSite cookies close the door on XSS token theft.
Every device session is visible in the dashboard. Inspect, filter, and revoke any of them with one click.
Every auth event is recorded and queryable. Know who signed in, from where, and what happened next.
Auther assumes every request is hostile until proven otherwise. Tokens stay out of JavaScript, sessions verify server-side on every call, and a revocation takes effect everywhere, immediately.