
Research
/Security News
737 Chrome VPN Extensions Linked to Brand Impersonation and Browser Traffic Redirection
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.
@authon/shared
Advanced tools
English | 한국어
Shared types and constants for Authon SDK packages. This package is consumed internally by @authon/js, @authon/react, @authon/node, and all other Authon SDKs.
Note: This package is not intended for direct use in application code. Install the appropriate framework SDK instead (e.g.,
@authon/js,@authon/react,@authon/node).
npm install @authon/shared
# or
pnpm add @authon/shared
import type {
AuthonUser,
AuthonSession,
AuthTokens,
BrandingConfig,
SessionConfig,
WebhookEvent,
MfaSetupResponse,
MfaStatus,
PasskeyCredential,
Web3Wallet,
Web3NonceResponse,
SessionInfo,
Web3Chain,
Web3WalletType,
OAuthProviderType,
WebhookEventType,
} from '@authon/shared';
import {
OAUTH_PROVIDERS,
PROVIDER_DISPLAY_NAMES,
PROVIDER_COLORS,
WEBHOOK_EVENTS,
API_KEY_PREFIXES,
DEFAULT_BRANDING,
DEFAULT_SESSION_CONFIG,
} from '@authon/shared';
AuthonUserThe authenticated user object.
interface AuthonUser {
id: string;
projectId: string;
email: string | null;
displayName: string | null;
avatarUrl: string | null;
phone: string | null;
emailVerified: boolean;
phoneVerified: boolean;
isBanned: boolean;
publicMetadata: Record<string, unknown> | null;
lastSignInAt: string | null;
signInCount: number;
createdAt: string;
updatedAt: string;
}
AuthonSessionAn active user session record (from the server SDK).
interface AuthonSession {
id: string;
userId: string;
ipAddress: string | null;
userAgent: string | null;
deviceName: string | null;
lastActiveAt: string | null;
createdAt: string;
expiresAt: string;
}
AuthTokensToken pair returned after a successful sign-in.
interface AuthTokens {
accessToken: string;
refreshToken: string;
expiresIn: number; // seconds
user: AuthonUser;
}
SessionInfoSimplified session info returned to clients (used in listSessions()).
interface SessionInfo {
id: string;
ipAddress: string | null;
userAgent: string | null;
createdAt: string;
lastActiveAt: string | null;
}
BrandingConfigVisual customization options for the Authon modal.
interface BrandingConfig {
logoDataUrl?: string;
brandName?: string;
primaryColorStart?: string;
primaryColorEnd?: string;
lightBg?: string;
lightText?: string;
darkBg?: string;
darkText?: string;
borderRadius?: number;
providerOrder?: string[];
hiddenProviders?: string[];
showEmailPassword?: boolean;
showDivider?: boolean;
termsUrl?: string;
privacyUrl?: string;
customCss?: string;
locale?: string;
showSecuredBy?: boolean;
}
SessionConfigSession lifetime and concurrency settings.
interface SessionConfig {
accessTokenTtl?: number; // seconds, default 900 (15 min)
refreshTokenTtl?: number; // seconds, default 604800 (7 days)
maxSessions?: number; // default 5
singleSession?: boolean; // default false
}
MfaSetupResponseReturned by setupMfa().
interface MfaSetupResponse {
secret: string; // TOTP secret
qrCodeUri: string; // otpauth:// URI
backupCodes: string[]; // one-time recovery codes
}
MfaStatusReturned by getMfaStatus().
interface MfaStatus {
enabled: boolean;
backupCodesRemaining: number;
}
PasskeyCredentialA registered WebAuthn passkey.
interface PasskeyCredential {
id: string;
name: string | null;
createdAt: string;
lastUsedAt: string | null;
}
Web3Chaintype Web3Chain = 'evm' | 'solana';
Web3WalletTypetype Web3WalletType =
| 'metamask'
| 'pexus'
| 'walletconnect'
| 'coinbase'
| 'phantom'
| 'trust'
| 'other';
Web3WalletA linked Web3 wallet.
interface Web3Wallet {
id: string;
address: string;
chain: Web3Chain;
walletType: Web3WalletType;
chainId: number | null;
createdAt: string;
}
Web3NonceResponseReturned by web3GetNonce().
interface Web3NonceResponse {
message: string; // full message to sign
nonce: string; // raw nonce embedded in message
}
WebhookEventIncoming webhook payload from Authon.
interface WebhookEvent {
id: string;
type: string;
projectId: string;
timestamp: string;
data: Record<string, unknown>;
}
WebhookEventTypetype WebhookEventType =
| 'user.created'
| 'user.updated'
| 'user.deleted'
| 'user.banned'
| 'user.unbanned'
| 'session.created'
| 'session.ended'
| 'session.revoked'
| 'provider.linked'
| 'provider.unlinked';
OAuthProviderTypetype OAuthProviderType =
| 'google'
| 'apple'
| 'kakao'
| 'naver'
| 'facebook'
| 'github'
| 'discord'
| 'x'
| 'line'
| 'microsoft';
OAUTH_PROVIDERSReadonly array of all supported OAuth provider identifiers.
const OAUTH_PROVIDERS: readonly OAuthProviderType[];
// ['google', 'apple', 'kakao', 'naver', 'facebook', 'github', 'discord', 'x', 'line', 'microsoft']
PROVIDER_DISPLAY_NAMESHuman-readable names for each provider.
const PROVIDER_DISPLAY_NAMES: Record<OAuthProviderType, string>;
// { google: 'Google', apple: 'Apple', github: 'GitHub', discord: 'Discord', ... }
PROVIDER_COLORSOfficial brand colors (background and text) for each provider button.
const PROVIDER_COLORS: Record<OAuthProviderType, { bg: string; text: string }>;
// { google: { bg: '#ffffff', text: '#1f1f1f' }, kakao: { bg: '#FEE500', text: '#191919' }, ... }
WEBHOOK_EVENTSReadonly array of all webhook event type strings.
const WEBHOOK_EVENTS: readonly WebhookEventType[];
API_KEY_PREFIXESPrefix strings for Authon API keys.
const API_KEY_PREFIXES: {
PUBLISHABLE_LIVE: 'pk_live_';
PUBLISHABLE_TEST: 'pk_test_';
SECRET_LIVE: 'sk_live_';
SECRET_TEST: 'sk_test_';
};
DEFAULT_BRANDINGDefault branding values applied when no project customization is set.
const DEFAULT_BRANDING: BrandingConfig;
// { primaryColorStart: '#7c3aed', primaryColorEnd: '#4f46e5', borderRadius: 12, ... }
DEFAULT_SESSION_CONFIGDefault session lifetime and concurrency settings.
const DEFAULT_SESSION_CONFIG: SessionConfig;
// { accessTokenTtl: 900, refreshTokenTtl: 604800, maxSessions: 5, singleSession: false }
Full documentation: docs.authon.dev
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The campaign amassed more than 75,000 installs by targeting Russian-speaking users seeking access to blocked services.

Company News
Open source maintainers are under more pressure than ever. We're raising our open source program from the Team plan to the Business plan, free.

Security News
The supply chain control that delays freshly published gems now covers lockfile generation and gem vendoring in Ruby projects.