Quickstarts

Each quickstart takes one framework from an empty project to either an API that accepts only valid KeenAuth access tokens or a web app that signs users in. Every quickstart comes from a runnable example whose tests run offline with the SDK test kit, so the code on these pages is the code that the tests check.

Protect your API

Framework	Quickstart
Go `net/http`	Protect a Go API
Node.js Express	Protect an Express API
Python FastAPI	Protect a FastAPI API
Python Django	Protect a Django API

The four API quickstarts build the same API: a public endpoint, an endpoint that needs a valid access token and an endpoint that also needs the messages:read scope. They read their configuration from environment variables only:

Variable	Meaning
`KEENAUTH_ISSUER`	Your environment's issuer, for example `https://your-environment.eu.keenauth.app`
`KEENAUTH_AUDIENCE`	Your API's identifier, the audience of its access tokens
`PUBLIC_BASE_URL`	The URL clients call; required, `https` (`http` only for `localhost`)

Sign users in

Framework	Quickstart
Next.js (App Router)	Add sign-in to a Next.js app
React single-page app (Vite)	Add sign-in to a React single-page app
React Router (framework mode)	Add sign-in to a React Router app
Laravel	Add sign-in to a Laravel app
Spring Boot	Add sign-in to a Spring Boot app
ASP.NET Core	Add sign-in to an ASP.NET Core app

The Next.js app is the OAuth client and keeps every token on the server; so does the React Router app, with the standard OpenID Connect client openid-client. The React single-page app is a public client: its tokens stay in the browser's memory, bound to a DPoP key. The other web apps use a standard OpenID Connect client library of their framework and keep every token in the server-side session. All of them read their configuration from environment variables (see each page) and call a protected API with the user's access token.

Fastify and Flask use the same middleware; see Protecting your API with middleware.