Authdog

Express

Authentication for Express backends

Protect your Node.js backend with session middleware, a requireAuth gate, and a logout handler. Key parsing, cookies, and the trusted-host allowlist are handled for you.

Start buildingRead the docs
npmlatestCI passing
One line to attach sessions
app.use(authdog.attachSession()) decorates req.authdog with a verified session. No per-route setup.
One enforcement point
Drop requireAuth onto a route and unauthenticated requests are rejected before your handler runs.
Key parsed at startup
A malformed or untrusted key throws at boot rather than failing per request, so misconfig surfaces fast.
Express 4 and 5
The same middleware drops into either major version, with no adapter layer.

Attach the session

// server.ts
import { createAuthdog } from "@authdog/express"

const authdog = createAuthdog({
  publicKey: process.env.PK_AUTHDOG!,
})

app.use(authdog.attachSession())

Gate routes with requireAuth

// routes.ts
app.get("/me", authdog.requireAuth, (req, res) => {
  res.json(req.authdog.user)
})

app.get("/logout", authdog.logout)

Node backend native

Everything Express APIs need

Session middleware, an auth gate, and a logout handler that drop into any Express 4 or 5 app.

01

Session middleware

attachSession() resolves the session for every request and decorates req.authdog with the token, user, and isAuthenticated flag.

  • req.authdog per request
  • Token, user, and flag
02

requireAuth gate

Protect any route with the requireAuth guard: the real enforcement point that rejects requests without a valid, verified session.

  • Rejects before your handler
  • Per-route or per-router
03

Secure by default

The public key is parsed once at startup and bearer tokens are only ever sent to a trusted, https identity host, enforced for you.

  • Trusted-host allowlist
  • https only
04

Tune the userinfo call

attachSession({ fetchUser: false }) skips the per-request user lookup for high-throughput services that validate tokens elsewhere.

  • Opt out of user lookup
  • Built for throughput
05

Logout handler

A built-in logout handler clears the session cookie and redirects to a sanitized target. No session teardown to write yourself.

  • Clears the cookie
  • Sanitized redirect target
06

Batteries included

Public-key parsing, cookie handling, and the trusted-host allowlist are shared with the rest of the Authdog Web SDK, and fully typed.

  • Shared with the Web SDK
  • Fully typed
01

Install

Add @authdog/express and your environment's public key.

02

Attach sessions

app.use(authdog.attachSession()) once, at the top.

03

Gate routes

Add requireAuth to the routes you protect.

Add auth to your Express API.

Install the SDK, attach the session middleware, and gate your routes with requireAuth today. Free to start, with secure defaults built in.

Start Building