Web SDK
@unet/id-web signs people in with UNET and calls the UNET API from a browser app. What it is, what it is for, and where to start.
@unet/id-web is the JavaScript SDK for browsers. It does the parts of "Sign in with UNET" that are easy to get wrong, and gives your app a typed client for the UNET API. It has no dependencies.
Two things in one package
An app can use either part, or both. They are different products with different rules, so it helps to know which one you are building.
| Sign in with UNET | A UNET client | |
|---|---|---|
| You want | to know who the person is | to act as the person inside UNET |
| You use | signIn, handleRedirectCallback, getUser, verifyAccessToken, verifyIdToken | unet.api.* (feed, posts, follows, notifications, ...) |
| Permissions | none beyond sign-in (openid profile) | one permission per kind of call, shown to the person |
| The id you get | a different one on every site, by default | the UNET user id (the API shows real ids) |
| Your server | verifies the token it is sent | has nothing to verify: UNET checks every request |
Read Sign in vs a UNET client once; it saves a lot of confusion later.
What is in the box
- Sign-in with the authorization code flow and PKCE. You never handle a password, a key or a client secret.
- Sessions that refresh by themselves, survive several tabs, and end cleanly when the person removes your app.
- A typed API client: feed, posts, comments, profiles, search, notifications, library, safety, settings, the Fediverse, media, and live updates over server-sent events.
- Server-side checks for the token your front end sends to your own backend.
- Debugging: every request the SDK makes can be traced, with secrets redacted.
Where to start
QuickstartA working sign-in in about five minutes.InstallationRequirements, bundlers, content security policy.How sign-in worksThe flow, step by step, with the pieces named.API referenceEvery method and type, generated from the source.
What the SDK does not do
- It does not run on a server: the sign-in and the API client need a browser. Only
verifyAccessTokenandverifyIdTokenare meant for your server. - It does not give you the person's email address. UNET accounts have none.
- It is not a UI kit: there is no button or modal in the package. The brand page has the official button.