ReadonlycapabilitiesReturns the capabilities requested by the flow at the time this token was signed.
Most auth-only flows pass an empty string to startCookieAuthFlow("", relay), so this will
commonly be an empty array.
Returns: string[], where each item is the canonical entry "<scope>:<actions>".
Example entry: "/pub/my-cool-app/:rw"
ReadonlypublicReturns the public key that authenticated with this token.
Use .toString() on the returned PublicKey to get the pubky<z32> identifier.
Call .z32() when you specifically need the raw z-base32 value (e.g. hostnames).
Serialize the token to a Uint8Array in its canonical (postcard) binary format.
Use this to send the token to a backend for verification.
const bytes = token.toBytes();
await fetch("/api/verify", { method: "POST", body: bytes });
StaticfromDeserialize an AuthToken without verification.
Most apps should call [AuthToken.verify()]. This is provided for tooling or diagnostics
where you want to inspect the structure first.
Throws if the bytes cannot be parsed as a valid serialized token.
StaticverifyParse and verify an AuthToken from its canonical bytes.
Use this on your server after receiving Uint8Array from the client.
import { AuthToken } from "@synonymdev/pubky";
export async function POST(req) {
const bytes = new Uint8Array(await req.arrayBuffer());
const token = AuthToken.verify(bytes); // throws on failure
return new Response(token.publicKey().toString(), { status: 200 });
}
AuthToken: signed, time-bound proof of key ownership.
Returned by [
AuthFlow.awaitToken()] on the 3rd-party app side when doing authentication-only flows (no homeserver session). You can inspect who authenticated and which capabilities were requested, or serialize the token and send it to a backend to verify.Typical usage
Binary format
AuthTokenserializes to a canonical binary (postcard) form; use [AuthToken.toBytes()] to get aUint8Array, and [AuthToken.verify()] to parse + verify on the server.