Authdog

TanStack Start

Authentication for TanStack Start

Add auth with the primitives TanStack Start already gives you: server functions and Web-standard loaders. The Authdog loader takes a Request and returns a Response, so it drops straight into your routes.

Start buildingRead the docs
npmlatestCI passing
One server function
Wrap identityLoader() in a createServerFn handler and your routes get a verified identity. No middleware indirection.
Web Fetch standard
The loader takes a standard Request and returns a standard Response, so it works with the framework's server primitives unchanged.
No tokens in the browser
Sessions stay in secure, HTTP-only cookies read only on the server, leaving nothing for client code to leak.
Refresh handled
Expired sessions renew inside the loader, with no extra round trip to write.

Resolve the session

// app/routes/index.tsx
import { createServerFn } from "@tanstack/react-start"
import { identityLoader } from "@authdog/tanstack-start"

export const loadIdentity = createServerFn({ method: "GET" }).handler(
  async () => (await identityLoader()({ request })).json(),
)

Wrap your app once

// app/router.tsx
import { AuthdogProvider } from "@authdog/tanstack-start/client"

<AuthdogProvider>
  {children}
</AuthdogProvider>

Web fundamentals, not magic

Everything TanStack Start apps need

Auth that works with server functions, Web-standard loaders, and cookie sessions, just as the framework was designed.

01

Web-standard loaders

TanStack Start speaks the Web Fetch API, so the auth loader takes a standard Request and returns a standard Response. It slots straight into your server functions and route loaders.

  • Request in, Response out
  • No adapter layer
02

Server functions

Resolve the session inside a createServerFn handler and hand a verified identity to your routes. Auth lives on the server, right where your data loading does.

  • createServerFn native
  • Verified identity per route
04

Secure by default

Tokens are validated against the trusted identity host and never exposed to browser code, so there's nothing for client scripts to read or leak.

  • Trusted identity host
  • Never exposed to the client
05

Automatic token refresh

Sessions renew transparently inside the loader, so expired tokens refresh without an extra round trip you have to write yourself.

  • Renewed in the loader
  • No extra round trip
06

Typed SDK

A fully typed SDK gives you autocomplete for the user, claims, and roles returned from the identity loader to your routes.

  • User, claims, and roles
  • Autocomplete in routes
01

Install

Add @authdog/tanstack-start and your environment keys.

02

Wrap the router

Add AuthdogProvider around your app.

03

Load the identity

Call identityLoader() from a server function.

Add auth to your TanStack Start app.

Install the SDK, wrap your app with the provider, and resolve the session in a server function today. Free to start, with secure defaults built in.

Start Building