5-minute quickstart

From npm install to bound sessions in 5 minutes.

Pick your server framework. Add one middleware. Every request after login is now signed by the user's device — replayed cookies bounce.

1. Install

bash

npm install @opensyber/tokenforge

2. Server

Drop in the adapter for your framework. requireFreshSig gates routes that need elevated trust (admin, payments, role grants).

Hono

Recommended

import { Hono } from 'hono';
import { tokenForgeMiddleware, requireFreshSig } from '@opensyber/tokenforge/hono';

const app = new Hono();
app.use('*', tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
app.use('/admin/*', requireFreshSig({ minTrustScore: 90 }));

app.get('/', (c) => c.text(`trust=${c.get('tf')?.trustScore ?? 0}`));
export default app;

Express

Node.js

import express from 'express';
import { tokenForgeMiddleware, requireFreshSig } from '@opensyber/tokenforge/express';

const app = express();
app.use(tokenForgeMiddleware({ apiKey: process.env.TOKENFORGE_API_KEY! }));
app.use('/admin', requireFreshSig({ minTrustScore: 90 }));

app.get('/', (req, res) => res.json({ trust: req.tf?.trustScore ?? 0 }));
app.listen(3000);

Fastify

Node.js

import Fastify from 'fastify';
import { tokenForgePlugin, requireFreshSig } from '@opensyber/tokenforge/fastify';

const fastify = Fastify();
fastify.register(tokenForgePlugin, { apiKey: process.env.TOKENFORGE_API_KEY! });
fastify.addHook('preHandler', async (req, reply) => {
  if (req.url.startsWith('/admin')) await requireFreshSig({ minTrustScore: 90 })(req, reply);
});

fastify.get('/', async (req) => ({ trust: req.tf?.trustScore ?? 0 }));
fastify.listen({ port: 3000 });

Next.js

App Router

// app/api/me/route.ts
import { withTokenForge } from '@opensyber/tokenforge/nextjs';

export const GET = withTokenForge(async (req, tf) => {
  return Response.json({ trust: tf.trustScore });
}, { apiKey: process.env.TOKENFORGE_API_KEY! });

SvelteKit

Edge

// src/hooks.server.ts
import { tokenForgeHandle } from '@opensyber/tokenforge/sveltekit';
export const handle = tokenForgeHandle({
  apiKey: process.env.TOKENFORGE_API_KEY!,
});

// src/routes/admin/+page.server.ts
import { requireFreshSig } from '@opensyber/tokenforge/sveltekit';
export const load = ({ locals }) => {
  requireFreshSig({ locals }, { minTrustScore: 90 });
  return { trust: locals.tf?.trustScore };
};

Astro

Edge

// src/middleware.ts
import { tokenForgeMiddleware } from '@opensyber/tokenforge/astro';
export const onRequest = tokenForgeMiddleware({
  apiKey: import.meta.env.TOKENFORGE_API_KEY,
});

// src/pages/admin/index.astro
---
import { requireFreshSig } from '@opensyber/tokenforge/astro';
const stepUp = requireFreshSig(Astro.locals, { minTrustScore: 90 });
if (stepUp) return stepUp;
---

3. Browser

Initialize the SDK once after the user signs in. init() binds the device and wraps the global fetch, so every request from then on is signed. Pass autoIntercept: false if you would rather sign requests yourself with signRequest().

// In your browser app (any framework)
import { TokenForge } from '@opensyber/tokenforge/client';

const tf = new TokenForge({
  apiBase: 'https://tokenforge-api.opensyber.cloud',
  // Required: how to read the current session from your auth provider.
  getSessionId: () => session?.id ?? null,
});

// Binds the device and installs the fetch interceptor. Every request
// after this is signed — no separate attach step.
await tf.init();

Trust-score thresholds

requireFreshSig({ minTrustScore: 90 }) gates against the score that tokenForgeMiddleware computes per request. Use these defaults until you have data to tune them.

90–100 · ALLOW

Bound device, clean signals. Default verdict.

40–89 · STEP_UP

Drift detected. Sensitive routes should reject; ordinary reads can proceed.

0–39 · BLOCK

Multiple high-confidence anomalies — middleware returns 401 automatically.

Phone apps and agents

Same trust-scoring engine, platform-native key storage, one API key across every platform.

Swift (iOS), Kotlin (Android), React Native, Python, Go, MCP Server

Done. What you got:

Every request after login carries an ECDSA P-256 signature bound to the user's device.
A stolen session cookie alone is useless — without the device key, signature verification fails.
requireFreshSig blocks admin / payment routes when the trust score drops (geo change, IP rotation, AitM signals).
Trust score and AitM signals surface in your dashboard.