5-minute quickstart

Protect a Node app

1. Create a service and an install token

In the dashboard, create a service, then under Instances generate a one-time installation token.

2. Install the SDK and register the instance

npm install @mylogin/sdk
npx @mylogin/sdk init --token inst_install_…

This generates an Ed25519 key on your machine (auth-instance.key, mode 600), registers only the public half, and writes .env.auth. The private key never leaves the host.

3. Add the middleware

Express

import express from 'express';
import { createAuth } from '@mylogin/sdk';
import { expressAuth } from '@mylogin/sdk/express';

const auth = createAuth({
  brokerUrl: process.env.AUTH_BROKER_URL!,
  projectId: process.env.AUTH_PROJECT_ID!,
  instanceId: process.env.AUTH_INSTANCE_ID!,
  privateKeyPath: process.env.AUTH_KEY_PATH!,
});
const app = express();
const a = expressAuth(auth);
app.use(a.routes());
app.get('/private', a.requireUser(), (req, res) => res.send(`Hello ${req.user.email ?? req.user.sub}`));
app.listen(3000);

Adapters for Fastify, Hono, and SvelteKit ship in the same package. The core works with any framework that uses Web Request and Response.

4. Test

Open /auth/login. You are sent to your service’s login host, sign in, and /auth/status completes the session. Run npx @mylogin/sdk doctor if anything fails.

Using an AI coding agent?

Paste this into Claude Code, Cursor, ChatGPT or similar.

Copy instructions

Add MyLogin.world authentication to this application.
Use the @mylogin/sdk package. Run "npx @mylogin/sdk init --token <TOKEN>" once to create the instance key; it writes .env.auth with AUTH_BROKER_URL, AUTH_PROJECT_ID, AUTH_INSTANCE_ID, AUTH_KEY_PATH.
Mount auth.routes() and protect every route except /auth/* with requireUser().
Do not implement passwords. Do not add an OAuth callback to this application’s URL. Do not store provider tokens.