Quickstart

The fastest path for a web app is the @axowl/sdk React package (or hosted login). Your users authenticate (passkey / magic link / social / SSO) and you get a verified session — you never handle credentials.

React (@axowl/sdk)

npm install @axowl/sdk

import { AxowlProvider, useAxowl, usePermission } from '@axowl/sdk';

// 1. Wrap your app with your org slug + app key
<AxowlProvider orgSlug="my-org" appKey="ak_live_xxxxx">
  <App />
</AxowlProvider>

// 2. Use hooks
function Page() {
  const { user, isSignedIn, signIn, signOut } = useAxowl();
  const { can } = usePermission();
  if (!isSignedIn) return <button onClick={() => signIn.magicLink('user@example.com')}>Sign in</button>;
  if (!can('dashboard.view')) return <p>Access denied</p>;
  return <p>Welcome, {user.name}!</p>;
}

Express backend (@axowl/sdk-backend)

import { axowlMiddleware, requirePermission } from '@axowl/sdk-backend';

app.use(axowlMiddleware({ orgSlug: 'my-org', apiKey: 'ah_live_xxxxx' }));
app.get('/api/reports', requirePermission('report.view'), (req, res) =>
  res.json({ userId: req.axowl.userId }));

Or use hosted login

Send users to the Axowl-hosted portal and receive a one-time code at your callback, then exchange it for the user’s JWT (verified against the org JWKS — no shared secret). See OIDC / OAuth2 for the standard flow.

Next steps

• Identity SDK — permission enforcement.
• Authentication model — org-native vs. end-user.