Skip to main content
The reference AFAuth implementation in TypeScript is four small packages. You install only the side you’re building: @afauthhq/agent for an agent, @afauthhq/server for a service (plus @afauthhq/worker on Cloudflare). @afauthhq/core is the shared foundation both sides pull in. See Installation for setup, or jump to a quickstart: build an agent or accept AFAuth on your service.

​
The four packages

PackageYou’re buildingKey surface
@afauthhq/agentAn agentAgent.generate(), signRequest, the protocol builders, TrustClient, AttestedFetcher
@afauthhq/serverA servicedefineService, Server, Verifier, the attestors, RateLimiter, the §10.7 attested-session gate
@afauthhq/workerA service on CloudflarecreateWorker + durable KV / D1 / Durable Object stores
@afauthhq/core(shared)did:key codec, RFC 9421 canonicalisation, recipient types, AFAuthError

​
How they compose

  Building an agent          Operating a service
  ─────────────────          ───────────────────
  @afauthhq/agent            @afauthhq/server
        │                    (+ @afauthhq/worker on Cloudflare)
        │                           │
        └────────────┬──────────────┘
                     ▼
               @afauthhq/core
        (shared primitives — usually transitive)
  • Building an agent? Install @afauthhq/agent — or skip code entirely and use the afauth CLI.
  • Operating a service? Install @afauthhq/server. On Cloudflare Workers, add @afauthhq/worker for createWorker and the durable stores.
  • @afauthhq/core comes along transitively — you rarely import it directly, except for shared types like AFAuthError and Recipient.
These overview pages map the surface; per-symbol typedoc reference is planned but not yet published. The quickstarts and guides carry runnable, copyable code for the common paths.

​
Where to next

Quickstart: build an agent

@afauthhq/agent end to end in five minutes.

Quickstart: accept AFAuth

@afauthhq/server with spam-resistant defaults.

Installation

npm / pnpm / yarn, Node 20+.

Use the CLI instead

The same agent flow with no code.