# Quickstarts

Each quickstart takes one framework from an empty project to either an API that accepts only valid KeenAuth access tokens or a web app that signs users in. Every quickstart comes from a runnable example whose tests run offline with the SDK test kit, so the code on these pages is the code that the tests check.

## Protect your API

| Framework | Quickstart |
|---|---|
| Go `net/http` | [Protect a Go API](/docs/quickstarts/go) |
| Node.js Express | [Protect an Express API](/docs/quickstarts/express) |
| Python FastAPI | [Protect a FastAPI API](/docs/quickstarts/fastapi) |
| Python Django | [Protect a Django API](/docs/quickstarts/django) |

The four API quickstarts build the same API: a public endpoint, an endpoint that needs a valid access token and an endpoint that also needs the `messages:read` scope. They read their configuration from environment variables only:

| Variable | Meaning |
|---|---|
| `KEENAUTH_ISSUER` | Your environment's issuer, for example `https://your-environment.eu.keenauth.app` |
| `KEENAUTH_AUDIENCE` | Your API's identifier, the audience of its access tokens |
| `PUBLIC_BASE_URL` | The URL clients call; required, `https` (`http` only for `localhost`) |

## Sign users in

| Framework | Quickstart |
|---|---|
| Next.js (App Router) | [Add sign-in to a Next.js app](/docs/quickstarts/nextjs) |
| React single-page app (Vite) | [Add sign-in to a React single-page app](/docs/quickstarts/react) |
| React Router (framework mode) | [Add sign-in to a React Router app](/docs/quickstarts/react-router) |
| Laravel | [Add sign-in to a Laravel app](/docs/quickstarts/laravel) |
| Spring Boot | [Add sign-in to a Spring Boot app](/docs/quickstarts/spring-boot) |
| ASP.NET Core | [Add sign-in to an ASP.NET Core app](/docs/quickstarts/dotnet) |

The Next.js app is the OAuth client and keeps every token on the server; so does the React Router app, with the standard OpenID Connect client `openid-client`. The React single-page app is a public client: its tokens stay in the browser's memory, bound to a DPoP key. The other web apps use a standard OpenID Connect client library of their framework and keep every token in the server-side session. All of them read their configuration from environment variables (see each page) and call a protected API with the user's access token.

Fastify and Flask use the same middleware; see [Protecting your API with middleware](/docs/sdk/protect-api).