Authentication > Auth Overview
Authentication > Auth OverviewKroxt BaaS SDK v1.0.5

Auth Overview

Kroxt BaaS is powered by the open-source authentication library Kroxt Auth under the hood. You can view, contribute to, or audit the core code directly on GitHub at github.com/kroxt/kroxt .

SDK Client Initialization

Initialize the client SDK with your workspace API credentials to automatically enable JWT session attachments on outgoing requests:

kroxt.ts
1
2
3
4
5
6
7
8
9
import { Kroxt } from "@kroxt/baas-sdk";

const baas = new Kroxt({
  projectId: "6a770f0a1efead4124b885fa",
  apiKey: "pk_dev_b5393c6502691084e14d1ced17254bfea78d72cf27aef420",
  // baseUrl is NOT needed unless you are running Kroxt BaaS locally on your machine.
  // In that case, point it to your local dev server:
  // baseUrl: "http://localhost:5000",
});
Response Payload (AuthSession):

A successful authentication request returns a standard response envelope containing the active session tokens and user profile:

response.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
{
  "success": true,
  "message": "Login successful",
  "data": {
    "user": {
      "id": "6a772ba11efead4124b88689",
      "email": "user@example.com",
      "name": "Adewale",
      "displayName": "Adewale",
      "status": "active",
      "emailVerified": false,
      "roles": ["user"],
      "lastLogin": "2026-08-08T23:28:48.991Z",
      "metadata": {}
    },
    "accessToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "refreshToken": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."
  }
}

Core Security Features

JWT Access & Refresh Tokens

Issues signed HMAC SHA-256 JWT access tokens (30m expiry) and refresh tokens (14d expiry) to secure frontend API calls automatically.

Brute-Force Lockout

Tracks consecutive failed password attempts per email and IP address, automatically suspending logins to block brute-force actions.

Brute-Force Lockout Error response:

If brute-force IP lockout is triggered (5 consecutive strikes), login requests are rejected with a `403 Forbidden` status code:

error.json
1
2
3
4
5
// Caught via SDK Try/Catch blocks as a KroxtError:
{
  "success": false,
  "message": "IP is temporarily blocked"
}