Vendidit Auth

One identity service. Browser, Node, and PHP SDKs. Shared HS256 tokens that every consumer validates locally.

What is this?

Vendidit Auth is one Go identity service plus a family of consumer SDKs that let any browser app or backend service authenticate against it. Tokens are short-lived HS256 JWTs that downstream services verify locally — no per-request network hop on the hot path.

Nine packages, four runtimes, one wire contract.

@vendidit/auth-server Go

The Go identity service. Owns users, orgs, roles, sessions, JWT signing. Single source of truth.

Docs → GitHub →

@vendidit/auth-shared TS types

Source-only TS package — JWT claims, principals, wire DTOs, error codes. Mirrors the server’s wire shape.

Docs → GitHub →

@vendidit/auth-client TS

Browser SDK — login, refresh-rotation, SSO/PKCE, 2FA, magic links. Framework adapters for React, Preact, Solid, Vue, Astro.

Docs → GitHub →

@vendidit/auth-client-demo Demo

Live integration reference at auth-demo.vendidit.com. 45 catalog pages plus full auth routes.

Docs → GitHub →

@vendidit/auth-server-ts TS

Framework-agnostic TS backend core. AuthClient facade, Flows, JwtValidator, HttpTransport, typed exception hierarchy.

Docs → GitHub →

@vendidit/auth-server-nest TS

NestJS adapter — module, guards, decorators. Wraps auth-server-ts. Ships Axios + Redis adapters out of the box.

Docs → GitHub →

@vendidit/auth-server-php PHP

Framework-agnostic PHP 8.1+ core. PSR-18 transport, PSR-16 cache, PSR-3 logger. Mirrors auth-server-ts.

Docs → GitHub →

@vendidit/auth-server-laravel PHP

Laravel adapter — VenAuth facade, middleware aliases, guard, Blade directives, HasVenAuth trait.

Docs → GitHub →

Pick your path

Browser app integrator Add login, refresh-rotation, SSO/PKCE, 2FA to a Preact, React, Solid, Vue, or Astro app.

NestJS backend developer Validate JWTs locally in a Nest service. Module + guards + decorators in five minutes.

Laravel backend developer Guard, middleware, Blade directives, HasVenAuth trait. Drop-in for any Laravel 11+ app.

Platform contributor Architecture, how a request flows, secret topology, app onboarding.

Hosted services

URL	What it is
`new-auth.vendidit.com`	Production auth-server (Go). API base: `/api/v1`. Health: `/health`.
`auth-demo.vendidit.com`	Live demo + visual feature catalog. Every atom, form, and flow the browser SDK ships has a working page.

Highlights

Local-first JWT validation — every backend SDK verifies HS256 signatures against a shared secret. Validation is microseconds, not milliseconds.
Refresh-token rotation with reuse detection — RFC 6819 §5.2.2.3 family revoke.
Pluggable transport / cache / session ports — every adapter is swap-in-able.
Multi-tenant orgs + app scoping — token claims carry org_id, app_id, and the union of role-derived permissions for that app’s services.
15-class typed exception hierarchy — same names in TS and PHP.
Symmetric design — auth-server-ts and auth-server-php mirror each other directory-for-directory.