Server SDK
Drive /verify/start, token exchange, userinfo, and /verify/validate from your backend with createKeyraServer.
On this page
Install
npm install git+https://github.com/Ciright-Inc/keyra-typescript-sdk.gitcreateKeyraServer
import { createKeyraServer } from "@keyra/typescript-sdk";
const keyra = createKeyraServer({
baseUrl: process.env.KEYRA_BASE_URL ?? "https://auth.keyra.ie",
// timeoutMs?: optional request timeout
});
// No clientSecret / sk_* in this factory.generatePkce
const { codeVerifier, codeChallenge, codeChallengeMethod } = keyra.generatePkce();
// codeChallengeMethod === "S256"Verification methods
| Method | Endpoint | Role |
|---|---|---|
createVerification | POST /verify/start | Start hosted verification; returns authorize_url |
exchangeAuthorizationCode | POST /oauth/token | Exchange code + code_verifier for access token |
getOAuthUserInfo | GET /oauth/userinfo | Bearer accessToken |
validateVerification | POST /verify/validate | Single-use trust boundary before your session |
const pkce = keyra.generatePkce();
// Persist codeVerifier server-side (session) keyed by state
const started = await keyra.createVerification({
client_id: process.env.KEYRA_PUBLISHABLE_CLIENT_ID!,
redirect_uri: "https://example.com/auth/keyra/callback",
code_challenge: pkce.codeChallenge,
code_challenge_method: pkce.codeChallengeMethod,
state: opaqueState,
scope: "verify",
});
// Return started.authorize_url to the browserToken exchange and userinfo details: Token exchange, User info.
validateVerification
const outcome = await keyra.validateVerification({
verification_token: tokenFromBrowser,
client_id: process.env.KEYRA_PUBLISHABLE_CLIENT_ID, // optional
});
if (!outcome.valid) {
// reject — do not create a session
}Deep dive: Server validation.
Web SDK dual export
@keyra/web-sdk also exports createKeyraServer and async generatePkce() for environments that share code between browser and Node. Prefer @keyra/typescript-sdk on dedicated backends for sync PKCE via Node crypto.
