Hosted service

The hosted service in apps/server is a Hono application built on the published packages. It exposes the API under /api/v1 and /api/config. CORS allows only the configured origin. This service is the reference for server setup.

Hono

@palmshed/auth-hono provides middleware and handlers:

import { Auth } from "@palmshed/auth-core";
import { middleware, createHandlers } from "@palmshed/auth-hono";
import { Hono } from "hono";

const auth = new Auth({ storage, config });
const app = new Hono();

app.use("/api/*", middleware(auth));
const h = createHandlers(auth);

app.post("/api/v1/signin", h.signIn);
app.post("/api/v1/signup", h.signUp);
app.post("/api/v1/signout", h.signOut);
app.get("/api/v1/session", h.session);
app.post("/api/v1/refresh", h.refresh);

middleware resolves the session from the Authorization header and attaches the user to the context. requireAuth() and requirePermission(scope, action) protect routes.

The Hono example in examples/hono is the complete runnable version.

Express

@palmshed/auth-express provides the same set as an Express router:

import { middleware, requireAuth, createRouter } from "@palmshed/auth-express";

app.use(express.json());
app.use(middleware(auth));
app.use("/api", createRouter(auth));

app.get("/api/admin", requireAuth(), (req, res) => {
  res.json({ ok: true, user: req.user });
});

The Express example in examples/express is the complete runnable version.

Password reset email

Pass an onPasswordReset(email, token) callback to the Auth constructor to send reset emails. The hosted service uses Resend when RESEND_API_KEY is set. Without a callback, forgot-password returns success without sending, so the endpoint cannot be used to enumerate accounts.