The `@authdog/angular` SDK integrates Authdog with standalone Angular apps: a DI provider, a signals-based service, an HTTP interceptor, and a route guard. It reads the [session](/docs/concepts/sessions-tokens) Authdog issues and attaches the bearer token to your API calls.

## Install

```package-install
@authdog/angular
```

Supports Angular `^17`–`^20` and `rxjs ^7.8`.

## Provide Authdog

Register `provideAuthdog` with your environment's **public key** (`pk_...`) and wire the interceptor into `HttpClient`:

```ts
import type { ApplicationConfig } from "@angular/core"
import { provideHttpClient, withInterceptors } from "@angular/common/http"
import { provideRouter } from "@angular/router"
import { provideAuthdog, authdogInterceptor } from "@authdog/angular"
import { routes } from "./app.routes"
import { environment } from "../environments/environment"

export const appConfig: ApplicationConfig = {
  providers: [
    provideRouter(routes),
    provideHttpClient(withInterceptors([authdogInterceptor])),
    provideAuthdog({
      publicKey: environment.authdogPublicKey,
      loginPath: "/",
    }),
  ],
}
```

`authdogInterceptor` attaches `Authorization: Bearer <token>` to outgoing requests. On startup the SDK stores `?token=` only when it matches a three-segment JWT regex, then removes it from the URL. This is a shape check, not cryptographic validation; it does not verify signature, issuer, audience, or expiry.

## Read the session

`AuthdogService` exposes Angular signals and sign-in/out methods. `publicKey` defaults to the value from `provideAuthdog`:

```ts
export class ProfileComponent {
  readonly auth = inject(AuthdogService)

  async ngOnInit() {
    await this.auth.fetchUser()
  }
  // auth.user(), auth.isAuthenticated(), auth.isLoading(), auth.error()
  // auth.signIn(), auth.signUp(), auth.signOut()
}
```

## Guard routes

`authdogGuard` is a `CanActivate` guard for gating client routes:

```ts
{ path: "profile", component: ProfileComponent, canActivate: [authdogGuard] }
```

The guard is a **UX convenience**, not a security boundary: a browser guard can be bypassed. `isAuthenticated()` becomes true only after `fetchUser()` returns a user, but protected API operations must still validate the attached bearer token with a [backend SDK](/docs/backend) and apply [authorization](/docs/concepts/authorization).

## Next steps

- [Sign up & sign in](/docs/authentication): the flows `signIn`/`signUp` drive.
- [Backend requests](/docs/backend): the real enforcement point for protected APIs.
- [Roles & permissions](/docs/permissions): the model behind authorization checks.