# @askrjs/server/auth

> Published API exports for @askrjs/server/auth.

Source: [https://askrjs.com/docs/reference/api/server/auth](https://askrjs.com/docs/reference/api/server/auth)

Status: stable. Packages: @askrjs/server/auth.

**Published packages are authoritative.** Examples may lag behind a published contract. When guidance differs, verify the exports and TypeScript declarations in your installed package, then file an issue.

## Exports

This entrypoint publishes 7 exports from the declarations shipped by @askrjs/server.

### `AuthCredentials`

```ts
AuthCredentials: any
```

Email/password credentials submitted to the register or authenticate endpoints.

- `email`: email: string;

- `password`: password: string;

### `AuthRouteError`

```ts
AuthRouteError: typeof AuthRouteError
```

Error thrown from `register`/`authenticate`/etc. callbacks to short-circuit an auth route with a specific status.

- `status`: readonly status: 401 | 409 | 429;

### `AuthRouteOptions`

```ts
AuthRouteOptions: any
```

Configuration for {@link registerAuthRoutes}.

- `issuer`: issuer: TokenIssuer<P>;

- `cookie`: cookie: CookieOptions & {
    name: string;
  };

- `principalSchema`: principalSchema: Schema;

- `register`: register(context: ServerContext, credentials: AuthCredentials): P | Promise<P>;

- `authenticate`: authenticate(context: ServerContext, credentials: AuthCredentials): P | null | Promise<P | null>;

- `allowAttempt`: allowAttempt(context: ServerContext, operation: "register" | "authenticate", normalizedEmail: string): boolean | Promise<boolean>;

- `revoke`: revoke?(context: ServerContext): void | Promise<void>;

- `redirect`: redirect?: (context: ServerContext, operation: "register" | "authenticate", principal: P) => string | undefined;

### `registerAuthRoutes`

```ts
registerAuthRoutes: <Dependencies, P extends Principal>(api: Pick<ApiDefinition<Dependencies>, "group">, options: AuthRouteOptions<P>) => void
```

Registers a standard set of authentication routes (`POST /auth/v1/accounts`,
`GET/POST /auth/v1/session`, `DELETE /auth/v1/session`) on an OpenAPI-style API/group,
handling registration, login, session lookup, and logout with CSRF protection via a
same-origin `Origin` header check, per-attempt rate limiting, and cookie-based token storage.

### `safeRedirect`

```ts
safeRedirect: (fallback: string, options?: SafeRedirectOptions) => (value: unknown) => string
```

Creates a validator that resolves an untrusted redirect target to a safe, same-origin,
relative path — or to `fallback` if the value is unsafe (absolute, protocol-relative,
contains a scheme, control characters, `..` traversal, backslashes, or an unwanted hash).

### `SafeRedirectOptions`

```ts
SafeRedirectOptions: any
```

Options for {@link safeRedirect}.

- `allowHash`: Allow redirect targets that include a URL fragment (`#...`). Defaults to disallowed.

### `TokenIssuer`

```ts
TokenIssuer: any
```

Issues auth tokens for a principal, used by {@link registerAuthRoutes} to mint session tokens.

- `issue`: issue(principal: Omit<P, "id"> & {
    subject: string;
  }): Promise<string>;

## Documentation navigation

[Previous](https://askrjs.com/docs/reference/api/server/askr/index.md) | [Next](https://askrjs.com/docs/reference/api/server/openapi/index.md)