zero-auth

Appearance

zero-auth API Documentation v1.2.0

zero-auth API Documentation / AuthConfig

Interface: AuthConfig ​

Defined in: src/types/auth.ts:8

Configuration passed to createAuth().

Properties ​

accessExpiresIn? ​

optional accessExpiresIn?: string

Defined in: src/types/auth.ts:14

Expiry for access tokens. Accepts zeit/ms strings like "15m", "1h".

Default ​

ts
"15m"

accessSecret ​

accessSecret: string

Defined in: src/types/auth.ts:10

Secret used to sign access tokens (HS256). Min 32 chars recommended.

cookies? ​

optional cookies?: CookieConfig

Defined in: src/types/auth.ts:18

Cookie configuration. If provided, token cookies are enabled.

csrf? ​

optional csrf?: CsrfConfig

Defined in: src/types/auth.ts:20

Optional CSRF protection for cookie-authenticated state-changing requests.

refreshExpiresIn? ​

optional refreshExpiresIn?: string

Defined in: src/types/auth.ts:16

Expiry for refresh tokens. Accepts zeit/ms strings like "7d", "30d".

Default ​

ts
"7d"

refreshOptions? ​

optional refreshOptions?: object

Defined in: src/types/auth.ts:22

Optional refresh behavior configuration

consumeRefreshToken? ​

optional consumeRefreshToken?: (oldJti, ctx?) => boolean | Promise<boolean>

Atomically consume the old refresh token before issuing replacements. Return true only when this call marks the jti for the first time; return false when it was already consumed. Use an atomic store operation such as Redis SET NX for multi-instance deployments.

Parameters ​
oldJti ​

string

ctx? ​

RefreshTokenContext

Returns ​

boolean | Promise<boolean>

isRevoked? ​

optional isRevoked?: (jti) => boolean | Promise<boolean>

Parameters ​
jti ​

string

Returns ​

boolean | Promise<boolean>

Deprecated ​

Use consumeRefreshToken for concurrency-safe rotation.

onRefreshReuse? ​

optional onRefreshReuse?: (ctx) => void | Promise<void>

Called when a revoked refresh token is presented (reuse detected). Use this to revoke the entire token family / force re-login.

Parameters ​
ctx ​

RefreshReuseContext

Returns ​

void | Promise<void>

registerRefreshToken? ​

optional registerRefreshToken?: (newJti, ctx) => void | Promise<void>

Called after a new refresh token is issued so stores can track the new jti under its family (needed for family revocation on reuse).

Parameters ​
newJti ​

string

ctx ​

RefreshTokenContext

Returns ​

void | Promise<void>

revokeRefreshToken? ​

optional revokeRefreshToken?: (oldJti, ctx?) => void | Promise<void>

Called with the old refresh token jti before new tokens are issued.

Parameters ​
oldJti ​

string

ctx? ​

RefreshTokenContext

Returns ​

void | Promise<void>

Deprecated ​

Use consumeRefreshToken for concurrency-safe rotation. Failures abort the refresh (fail closed). Optional second ctx includes userId and familyId for family-aware stores.

rotate? ​

optional rotate?: boolean

When true, issue a new refresh token alongside the new access token. Use consumeRefreshToken for atomic replay protection. In 1.1.x, the legacy hook pair remains accepted with a warning. A stable fid (family id) claim is auto-injected when missing.

Default ​
ts
false

refreshSecret ​

refreshSecret: string

Defined in: src/types/auth.ts:12

Secret used to sign refresh tokens (HS256). Min 32 chars recommended.