Choose an SDK#
First-party libraries share the same identity contracts across five languages. Choose the runtime your backend uses. Browser sign-in uses a backend-for-frontend or your own login interface; backend client secrets never belong in a browser.
| Runtime | Guide | Framework support |
|---|---|---|
| Go | Go SDK | net/http, request metadata, multiple issuers |
| Node.js 20.10+ | Node.js & TypeScript | Express/Connect, node:http, Fastify |
| Dart | Dart & Flutter backends | Dart-only core and dart:io; no Flutter dependency |
| PHP 8.2+ | PHP | Plain PHP and PSR-15 authentication helpers |
| .NET 8+ | C# & ASP.NET Core | Authentication scheme and middleware |
Shared capabilities#
- Offline JWT verification with a configured issuer and audience.
- Strict-online introspection and audited support-access enforcement.
- Bounded-state verification using the session-event stream.
- Authorization code with PKCE, ID-token validation, serialized refresh and logout.
- Administration clients with cursor pagination, ETags, problem details and explicitly revealed one-time secrets.
Sender-constrained DPoP/mTLS token handling differs by SDK. The Go SDK supplies a request-level sender verifier; token-only methods in the other SDKs reject bound tokens. Check the resource-server profile before selecting an adapter.
Installation and maturity#
The five independent source repositories are public under
proudbase:
Go,
Node,
Dart,
PHP and
.NET.
The libraries retain development version 0.2.0. npm, Pub, Packagist and NuGet packages remain unpublished; the individual guides explain source installation and local package creation. Go can install its pinned public module commit. Independent CI covers each SDK's declared runtime matrix; .NET runs its strict signature and invalid-key regression vectors on Linux, macOS and Windows.
Read runtime compatibility and interoperability evidence for exact tested versions and limitations. A package's minimum runtime is distinct from a locally tested runtime and from a configured CI runtime.