Skip to content

Quickstart

The fastest path for a web app is the @axowl/sdk React package (or hosted login). Your users authenticate (passkey / magic link / social / SSO) and you get a verified session — you never handle credentials.

React (`@axowl/sdk`)

npm install @axowl/sdk

import { AxowlProvider, useAxowl, usePermission } from '@axowl/sdk';

// 1. Wrap your app with your org slug + the application's client key
<AxowlProvider orgSlug="my-org" appKey="client_...">
  <App />
</AxowlProvider>

// 2. Use hooks
function Page() {
  const { user, isSignedIn, signIn, signOut } = useAxowl();
  const { can } = usePermission();
  if (!isSignedIn) return <button onClick={() => signIn.magicLink('[email protected]')}>Sign in</button>;
  if (!can('dashboard.view')) return <p>Access denied</p>;
  return <p>Welcome, {user.name}!</p>;
}

appKey is the client key of the application you registered (Applications → your app; one per platform × environment). Prefer the drop-in <SignIn /> component when you want the app group’s configured methods (passkey, magic link, social) rendered for you.

Express backend (`@axowl/sdk-backend`)

import { axowlMiddleware, requirePermission } from '@axowl/sdk-backend';

app.use(axowlMiddleware({ orgSlug: 'my-org', apiKey: 'ah_live_xxxxx' }));
app.get('/api/reports', requirePermission('report.view'), (req, res) =>
  res.json({ userId: req.axowl.userId }));

apiKey is an org API key (ah_live_...) — see Public API. For Next.js route handlers use getAuth / canAccess from @axowl/sdk-backend/next.

Send users to the Axowl-hosted portal ({portal}/login/{clientKey}) and receive a one-time code at your callback, then exchange it for the user’s JWT (verified against the org JWKS — no shared secret). See Hosted login and OIDC / OAuth2.

Next steps

Identity SDK — permission enforcement.
Authentication model — org-native vs. end-user.