Backend Integrations

AuthAction issues JWT access tokens that your backend APIs validate using standard JWKS-based verification. Official SDKs handle key fetching, caching, and rotation automatically — or follow the manual guides to integrate with the library of your choice.

Official AuthAction SDKs

SDK	Frameworks	Install
`@authaction/node-sdk`	Express, Fastify, NestJS, Apollo GraphQL	`npm install @authaction/node-sdk`
`authaction-python-sdk`	Django, Flask, FastAPI	`pip install authaction-python-sdk`
`authaction-spring-boot-starter`	Spring Boot	Maven / Gradle
`authaction-java-sdk`	Any Java app (Servlet, Quarkus, Micronaut)	Maven / Gradle
`authaction-go-sdk`	net/http, Gin	`go get github.com/authaction/authaction-go-sdk`
`authaction-rust-sdk`	Actix-web, Axum	`cargo add authaction`
`authaction-php-sdk`	Laravel, PSR-15, plain PHP	`composer require authaction/authaction-php-sdk`

Available Guides

Express.js: Official SDK (@authaction/node-sdk/express) or jwks-rsa + express-jwt
NestJS: Official SDK (@authaction/node-sdk/nestjs) or Passport JWT strategy
Apollo GraphQL: Official SDK (@authaction/node-sdk/apollo) or jwks-rsa
Spring Boot: Official SDK (authaction-spring-boot-starter) or Spring Security OAuth2
Go: Official SDK (authaction-go-sdk) or golang-jwt + jwx
.NET: ASP.NET Core JWT Bearer authentication
Django: Official SDK (authaction-python-sdk[django]) or python-jose
Flask: Official SDK (authaction-python-sdk[flask]) or python-jose
Ruby on Rails: Rails API concern with the jwt gem and JWKS caching
Rust (Actix-web): Official SDK (authaction-rust-sdk) or jsonwebtoken + reqwest
PHP: Official SDK (authaction-php-sdk) or firebase/php-jwt
Laravel: Official SDK (authaction-php-sdk) or lcobucci/jwt

How It Works

Your frontend obtains an access token from AuthAction
The frontend sends the token in the Authorization: Bearer <token> header
Your backend validates the token’s signature against AuthAction’s JWKS endpoint
If valid, the request is authorized; otherwise a 401 Unauthorized response is returned

All implementations validate the issuer, audience, and RS256 signature of the JWT to ensure the token is legitimate and intended for your API.