@kothatech/auth-node

A Node.js SDK for verifying Kotha Auth RS256 JWTs using our JWKS endpoints.

npm install @kothatech/auth-node

Express Middleware Example

const express = require('express');
const { KothaAuthNode } = require('@kothatech/auth-node');

const auth = new KothaAuthNode({
  issuer: 'https://auth.kotha.im', // Or http://localhost:4000
  clientId: 'YOUR_CLIENT_ID',
  clientSecret: process.env.KOTHA_CLIENT_SECRET
});

const app = express();

app.get('/api/protected', auth.expressMiddleware({ audience: 'app_your_client_id' }), (req, res) => {
  res.json({ message: 'Success!', user: req.user });
});

Refresh and Revoke

let tokens = await auth.refreshTokens(savedRefreshToken, {
  deviceId: 'stable-device-id' // Only for device-bound sessions
});

// Persist the replacement atomically.
savedRefreshToken = tokens.refresh_token;

await auth.revokeToken(savedRefreshToken, {
  tokenTypeHint: 'refresh_token'
});

Refresh and revocation require Node.js 18 or newer. Offline JWT verification does not immediately detect revocation, so use short-lived access tokens or server-side session validation where immediate revocation is required.