Status legend
Every SDK below carries one of two status labels, aligned with the XID platform support matrix. Neither label is a production-readiness claim.
| Status | Meaning |
|---|---|
| Current package | TypeScript package maintained in the XID repository with source, tests, and workspace wiring. |
| Implemented · verified locally | Native SDK that compiles and passes its unit test suite on a local toolchain. A round-trip against a real production IdP still requires manual verification. |
Server-side SDKs
Web-standard runtimes (Cloudflare Workers, Node.js, Bun, Deno) share @xid-kit/backend via Web Crypto. Other languages get native SDKs. All do networkless JWT verification, request authentication, and webhook verification.
| Runtime or language | Package or directory | Status | Responsibility |
|---|---|---|---|
| Cloudflare Workers | @xid-kit/backend |
Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Node.js | @xid-kit/backend |
Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Bun | @xid-kit/backend |
Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Deno | @xid-kit/backend |
Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Go | sdk/go |
Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Java | sdk/java |
Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Rust | sdk/rust |
Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| PHP | sdk/php |
Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Ruby | sdk/ruby |
Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Python | sdk/python |
Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| .NET | sdk/dotnet |
Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
Client SDKs: web frameworks
| Framework | Package or directory | Status | Responsibility |
|---|---|---|---|
| Vanilla JS / Web | @xid-kit/core |
Current package | Browser client, session store, token cache, and Management API helpers. |
| React | @xid-kit/react |
Current package | Provider, hooks, control components, user UI, and organization UI. |
| Next.js | @xid-kit/nextjs |
Current package | Middleware, App Router helpers, Pages Router helpers, and React re-exports. |
| Vue | @xid-kit/vue |
Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Nuxt | @xid-kit/nuxt |
Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Svelte / SvelteKit | @xid-kit/svelte |
Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Angular | @xid-kit/angular |
Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Remix | @xid-kit/remix |
Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Astro | @xid-kit/astro |
Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| SolidJS | @xid-kit/solid |
Current package | Provider, hooks or composables, and prebuilt user and organization components. |
Client SDKs: mobile
| Platform | Package or directory | Status | Responsibility |
|---|---|---|---|
| React Native | @xid-kit/react-native |
Current package | Hosted redirect, deep link callback, PKCE S256, and secure storage adapter contract. |
| Expo | @xid-kit/expo |
Current package | Expo Router integration, AuthSession, and SecureStore adapter. |
| Flutter | sdk/flutter |
Implemented · verified locally | Hosted redirect, app link callback, and secure storage adapter. |
| iOS | sdk/ios |
Implemented · verified locally | ASWebAuthenticationSession, Keychain storage, and PKCE S256. |
| Android | sdk/android |
Implemented · verified locally | Custom Tabs, App Links, Keystore-backed storage, and PKCE S256. |
Client SDKs: desktop
| Platform | Package or directory | Status | Responsibility |
|---|---|---|---|
| macOS | sdk/macos |
Implemented · verified locally | ASWebAuthenticationSession, Keychain storage, and PKCE S256. |
| Windows | sdk/windows |
Implemented · verified locally | WebView2 redirect, DPAPI secure storage, and PKCE S256. |
| Linux | sdk/linux |
Implemented · verified locally | System browser redirect, Secret Service storage, and PKCE S256. |
| Electron | @xid-kit/electron |
Current package | Main and renderer bridge, safeStorage, and loopback or custom scheme callbacks. |
| Tauri | @xid-kit/tauri |
Current package | Rust backend bridge, OS keychain, and PKCE S256. |
Shared native contract
- Native public clients use authorization code with PKCE S256. Implicit flow and password grant are not supported.
- Redirect callbacks are claimed app links, universal links, custom schemes, or platform equivalent callback URLs.
- Storage adapters keep refresh tokens or session cache values in platform secure storage and never store client secrets.
- JS and TS native SDKs (React Native, Expo) use a React provider plus hooks model: XidProvider, useSignIn, and useSignOut.
- Other native SDKs (iOS, Android, Flutter, desktop) use a functional configure, signIn, and handleRedirect API surface.
Package guides
Each SDK has a dedicated reference page with install steps, API tables, and copy-paste examples. The SDK packages group in the sidebar lists every reference page; the most used web packages are:
- @xid-kit/core — browser session, tokens, Management API helpers.
- @xid-kit/backend — networkless JWT verify, request auth, webhooks.
- @xid-kit/react — provider, hooks, control and UI components.
- @xid-kit/nextjs — middleware and App/Pages Router server helpers.
- @xid-kit/react-native — Hosted Auth redirect, PKCE S256, secure token storage for native apps.