> ## Documentation Index
> Fetch the complete documentation index at: https://docs.afauth.org/llms.txt
> Use this file to discover all available pages before exploring further.

# @afauthhq/server

> Service-side SDK: defineService, Verifier, Server handlers (incl. owner re-key/revoke + §10.7 verifyAttested), RateLimiter, Attestor, Memory stores.

<Note>Overview only. Per-symbol typedoc reference is planned but not yet published.</Note>

## Entry points

* **`defineService(opts)`** — opinionated convenience factory. Returns
  a `Server` with `attestation: "required"` defaults
  (`unclaimed_mode: "attested_only"` in the discovery doc + bundled
  `trustAttestor()`). With this default, an un-attested signup is
  rejected with `401 attestation_required`; an agent reaches it by
  linking to a human and minting a per-service JWT via
  [`TrustClient`](/sdk/typescript/agent/overview) (or `afauth trust link`
  * `afauth signup`). Use this for new integrations; opt out with
    `attestation: "off"` (paid/read-only) or `"optional"` (migration path).
    Synthesizes the discovery doc from `baseUrl` + `serviceDid` and
    accepts a `discovery` override for partial customization. A human's
    agents are **grouped onto one account** by their `(iss, sub_h)` (§10.4.4:
    one account, many devices) — automatic for any `AccountStore`, no option
    needed.
* **`new Server({...})`** — the lower-level constructor. Pass an
  explicit `DiscoveryDocument`, attestor, nonce store, etc. Use when
  you need `MultiAttestor`, a custom `HmacAttestor`, or full discovery
  control.
* **`Verifier`** — standalone §5.5/§5.6 request verifier. Use directly
  at an edge proxy or sidecar that fronts a service backend.
* **`server.verifyAttested(req)` + `attestedSession`** — the §10.7
  attested-session gate. Configure `attestedSession: { store, mode }`
  (with an `attestor`) and call `verifyAttested` on your own
  authenticated endpoints: it verifies the signature, refreshes the
  session when the agent re-presents an attestation, and challenges
  with `401 attestation_required` when the freshness window lapses.
  Stores: `MemoryAttestedFreshnessStore` here, `KvAttestedFreshnessStore`
  in [`@afauthhq/worker`](/sdk/typescript/worker/overview). See
  [Keep attested access live](/guides/keep-attested-access-live).
* **Multi-agent accounts** (§10.4.4) — an `Account` is keyed on an opaque
  `account_id` and holds one or more agent credentials (`agents[]`). At
  signup, an agent presenting a verified `(iss, sub_h)` that a human already
  has **attaches to that account** (`AccountStore.signupAgent` →
  `attached: true`) — one account, many devices. Agents with no `sub_h`
  (attestation off/optional, runtime-only) get singleton accounts. Key
  rotation keeps `account_id` stable; resolve an account from a request via
  `accounts.getByAgentDid(did)`.

See [Accept AFAuth on your service](/quickstart-service)
for the integration walkthrough and the [attestation concept](/concepts/attestation)
for what the defaults actually enforce.