Device-bound session security. Add one script tag — every request is cryptographically signed with a device key that never leaves the browser. A stolen cookie without the device key is useless.

Quick Start

1. Add the script tag (client — zero code)

<script
  src="https://tokenforge-api.opensyber.cloud/sdk.js"
  data-api-key="tf_your_api_key"
></script>

That's it. The script auto-generates ECDSA P-256 device keys, binds the session, and signs every fetch() request with X-TF-* headers.

2. Add server middleware (one line)

npm install @opensyber/tokenforge

Express

import { tokenForgeMiddleware } from '@opensyber/tokenforge/express';
app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
// req.tf.bound, req.tf.trustScore, req.tf.deviceId

Next.js

import { withTokenForge } from '@opensyber/tokenforge/nextjs';
export const GET = withTokenForge(handler, { apiKey: process.env.TOKENFORGE_API_KEY! });

Fastify

import { tokenForgePlugin } from '@opensyber/tokenforge/fastify';
fastify.register(tokenForgePlugin, { apiKey: process.env.TOKENFORGE_API_KEY! });

Hono

import { tokenForgeMiddleware } from '@opensyber/tokenforge/hono';
app.use('/api/*', tokenForgeMiddleware({ apiKey: env.TOKENFORGE_API_KEY }));

3. Get your API key

Why

Authentication protects login. TokenForge protects everything after login:

Session hijacking — stolen cookies are useless without the device's private key
AiTM attacks — relay proxies can't sign requests on behalf of the device
Token theft — XSS-exfiltrated tokens fail server-side signature verification
Trust scoring — 7 signals detect anomalies on every request in real time

How It Works

Browser                        TokenForge API                Your Server
  │                                │                              │
  │ 1. Script auto-generates       │                              │
  │    ECDSA P-256 key pair        │                              │
  │                                │                              │
  │ 2. POST /v1/bind ─────────────>│ Store public key             │
  │ <──────────────────────────────│ Return deviceId              │
  │                                │                              │
  │ 3. fetch('/api/data')          │                              │
  │    + X-TF-Signature header ────────────────────────────────>  │
  │                                │                              │
  │                                │ <── POST /v1/edge/verify ──  │
  │                                │     Verify signature         │
  │                                │     Check nonce replay       │
  │                                │     Compute trust score      │
  │                                │ ── { allow, score: 92 } ──> │
  │                                │                              │
  │ <──────────────────────────────────── 200 OK ─────────────── │

All verification runs on TokenForge's infrastructure. Your server sends request context, gets back allow/deny. No crypto libraries, no database, no storage to manage.

Trust Score

7 signals scored 0-100 on every request:

Signal	Weight	Detects
Signature	30	Tampering, missing device key
IP Address	15	IP change since binding
Geo Location	15	Country mismatch
Fingerprint	15	Browser fingerprint drift
Velocity	10	Multiple IPs in short window
Timing	10	Clock skew beyond tolerance
Nonce	5	Replay attacks

Score >= 80: allow. Score 40-79: step-up auth. Score < 40: block.

Advanced: npm Client SDK

For React apps or when you need more control than the script tag:

import { TokenForgeProvider, useTokenForge } from '@opensyber/tokenforge/react';

function App() {
  return (
    <TokenForgeProvider config={{
      apiBase: '/api',
      getSessionId: () => getSession(),
    }}>
      <YourApp />
    </TokenForgeProvider>
  );
}

Works With Any Auth Provider

Microsoft Entra ID, Clerk, Auth.js, NextAuth, Firebase, Supabase, Okta, or custom JWT. TokenForge runs after authentication — no changes to your auth flow.