
Security News
6 AppSec CTOs Debate Open Source Supply Chain Security at Black Hat
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.
@authon/shared
Advanced tools
English | 한국어
Shared types and constants for all Authon SDKs
Internal package consumed by @authon/js, @authon/react, and all other Authon frontend SDKs. Not intended for direct application use -- install the appropriate framework SDK instead.
Before installing the SDK, create an Authon project and get your API keys:
Create a project at Authon Dashboard
Get your API keys from Project Settings → API Keys
pk_live_...) — use in your frontend codepk_test_...) — for development, enables Dev TeleportConfigure OAuth providers (optional) in Project Settings → OAuth
https://api.authon.dev/v1/auth/oauth/redirectTest vs Live keys: Use
pk_test_...during development. Switch topk_live_...before deploying to production. Test keys use a sandbox environment with no rate limits.
npm install @authon/shared
import type {
AuthonUser,
AuthTokens,
OAuthProviderType,
PasskeyCredential,
Web3Wallet,
MfaSetupResponse,
SessionInfo,
BrandingConfig,
WebhookEvent,
AuthonOrganization,
} from '@authon/shared';
import {
OAUTH_PROVIDERS,
PROVIDER_DISPLAY_NAMES,
PROVIDER_COLORS,
WEBHOOK_EVENTS,
API_KEY_PREFIXES,
DEFAULT_BRANDING,
DEFAULT_SESSION_CONFIG,
AUDIT_EVENTS,
} from '@authon/shared';
import type { AuthonUser } from '@authon/shared';
function greet(user: AuthonUser) {
return `Hello, ${user.displayName ?? user.email}`;
}
import { PROVIDER_COLORS, PROVIDER_DISPLAY_NAMES } from '@authon/shared';
const google = PROVIDER_COLORS.google;
// { bg: '#ffffff', text: '#1f1f1f' }
const label = PROVIDER_DISPLAY_NAMES.google;
// 'Google'
import { API_KEY_PREFIXES } from '@authon/shared';
function isSecretKey(key: string) {
return key.startsWith(API_KEY_PREFIXES.SECRET_LIVE) || key.startsWith(API_KEY_PREFIXES.SECRET_TEST);
}
Not applicable -- this is a types-only package. See the framework-specific SDK for environment variable setup.
| Type | Description |
|---|---|
AuthonUser | User object (id, email, displayName, avatarUrl, metadata, etc.) |
AuthTokens | { accessToken, refreshToken, expiresIn, user } |
OAuthProviderType | 'google' | 'apple' | 'github' | 'discord' | ... (10 providers) |
PasskeyCredential | { id, name, createdAt, lastUsedAt } |
Web3Wallet | { id, address, chain, walletType, chainId } |
Web3Chain | 'evm' | 'solana' |
Web3WalletType | 'metamask' | 'phantom' | 'walletconnect' | ... |
MfaSetupResponse | { secret, qrCodeUri, backupCodes } |
MfaStatus | { enabled, backupCodesRemaining } |
SessionInfo | { id, ipAddress, userAgent, createdAt, lastActiveAt } |
BrandingConfig | Visual customization for the auth modal |
WebhookEvent | { id, type, projectId, timestamp, data } |
AuthonOrganization | Organization with id, name, slug, members |
| Constant | Value |
|---|---|
OAUTH_PROVIDERS | ['google', 'apple', 'kakao', 'naver', 'facebook', 'github', 'discord', 'x', 'line', 'microsoft'] |
WEBHOOK_EVENTS | ['user.created', 'user.updated', 'user.deleted', ...] |
API_KEY_PREFIXES | { PUBLISHABLE_LIVE: 'pk_live_', SECRET_LIVE: 'sk_live_', ... } |
DEFAULT_BRANDING | Default modal theme colors and settings |
DEFAULT_SESSION_CONFIG | { accessTokenTtl: 900, refreshTokenTtl: 604800, maxSessions: 5 } |
AUDIT_EVENTS | Audit log event type constants |
| Feature | Authon | Clerk | Auth.js |
|---|---|---|---|
| Pricing | Free | $25/mo+ | Free |
| Shared types package | Yes | Yes | No |
| OAuth providers | 10+ | 20+ | 80+ |
MIT
FAQs

Security News
Socket CTO Ahmad Nassri joins AppSec leaders at Black Hat to discuss active malware, package manager risks, and software supply chain defense.

Research
/Security News
Thirteen malicious Packagist themes expose visitors on unpatched iPhones to a WebKit-to-kernel exploit chain that steals device data and wallet seeds.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.