SDK overview

✅ Verified

Against the axowl-sdk repo (README.md, packages/react, packages/backend, packages/core, python, java) and this repo’s Axowl.Sdk.* projects (.NET) — 2026-09-22.

Axowl ships four SDK families. Web front-ends use the JS/TS one; on the server pick the client for your runtime — .NET, Node, Python or Java. Every backend SDK does the same three things the same way: verify the end-user token against your org’s JWKS, read permissions with the same wildcard rules, and (optionally) ask Axowl for a server-authoritative answer.

Runtime	Package	Registry	Page
Node / Next.js	@axowl/sdk-backend	npm	below
.NET	Axowl.Sdk.Identity.Client	NuGet / GitHub Packages	Identity
Python 3.9+	axowl-sdk	PyPI	Python
Java 17+	com.axowl:axowl-sdk	Maven Central	Java

JavaScript / TypeScript (axowl-sdk repo)

Package	Purpose
@axowl/sdk (packages/react)	React provider, hooks & components — AxowlProvider, useAxowl, usePermission, useSession, useOrg, plus drop-in SignIn, SignInButton, UserButton
@axowl/sdk-backend (packages/backend)	Express middleware (axowlMiddleware, requirePermission) and Next.js helpers (getAuth, getAuthAsync, canAccess); JWT verification against the org JWKS (verifyTokenAsync)
@axowl/sdk-core (packages/core)	Shared client, token store and permission matching (used internally)
@axowl/sdk-wasm (packages/sdk-wasm)	WASM integrity-verification core

import { AxowlProvider, useAxowl, usePermission } from '@axowl/sdk';

<AxowlProvider orgSlug="my-org" appKey="client_..."><App /></AxowlProvider>

const { user, isSignedIn, signIn } = useAxowl();
const { can } = usePermission();           // can('dashboard.view')

appKey is the application’s client key (client_..., one per platform × environment, from Applications in the dashboard). The client talks to /api/public/apps/{appKey}/... — login methods, magic link, social, federated, passkey, session handshake.

Features: magic link, social, passkey (FIDO2), and federated (OIDC) sign-in; JWT auto-refresh; wildcard permission matching (sap.fi.*); Express req.axowl context; Next.js App Router & Middleware support; TypeScript-first.

.NET (Axowl.Sdk.*, this repo)

Project	Purpose	Page
Axowl.Sdk.Identity.Client	Introspection, permission checks, [RequirePermission]	Identity
Axowl.Sdk.Integrity.Client	Verify sealed records (REST/gRPC/Fallback)	Integrity
Axowl.Sdk.Eventing.Client	Publish custom events / poll sealed events	Eventing
Axowl.Sdk.Korean.Identity.Client	[RequireKoreanIdentity] gating	Korean Identity

Each client uses a 3-layer transport (REST + gRPC over h2c + fallback), confirmed by the Rest*Client / Grpc*Client / Fallback*Client files in each project. A separate Blazor/.NET end-user auth package lives in axowl-sdk/dotnet — see .NET EndUser auth.

Python (axowl-sdk/python)

pip install axowl-sdk. verify_token (RS256 against the org JWKS, issuer/audience/expiry), AxowlContext with typed claims and a decoded permission list, axowl.fastapi.AxowlAuth (dependency + require("scope")), and AxowlIdentityClient for introspect / check-permission. See Python SDK.

Java (axowl-sdk/java)

com.axowl:axowl-sdk. AxowlTokenVerifier (RS256 against the org JWKS, cached and rate-limited), AxowlContext record, Permissions (wildcard matching + require), AxowlAuthFilter for servlet containers such as Spring Boot, and AxowlIdentityClient for introspect / check-permission. See Java SDK.

The token every backend SDK verifies

An Axowl end-user access token is an RS256 JWT with iss = {api}/api/public/orgs/{orgSlug}, aud = your application key, sub = end-user id, and the claims email, org, org_slug, app, app_group, type ("enduser"), is_employee, cid (the user’s org badge) and permissions (a JSON-encoded string array). Keys are published per organization at {api}/api/public/orgs/{orgSlug}/.well-known/jwks.json. All four backend SDKs verify against exactly that, so a token accepted by one is accepted by the others.