---
title: "SDKs"
description: "TypeScript packages and locally verified native SDKs for server, web, mobile, and desktop."
locale: "en"
---

> Documentation Index
> Fetch the locale documentation index at: https://xid.dev/en/llms.txt
> Use this file to discover all available pages before exploring further.

# SDKs

## Status legend

Every SDK below carries one of two status labels, aligned with the XID platform support matrix. Neither label is a production-readiness claim.

| Status | Meaning |
| --- | --- |
| Current package | TypeScript package maintained in the XID repository with source, tests, and workspace wiring. |
| Implemented · verified locally | Native SDK that compiles and passes its unit test suite on a local toolchain. A round-trip against a real production IdP still requires manual verification. |

## Server-side SDKs

Web-standard runtimes (Cloudflare Workers, Node.js, Bun, Deno) share @xid-kit/backend via Web Crypto. Other languages get native SDKs. All do networkless JWT verification, request authentication, and webhook verification.

| Runtime or language | Package or directory | Status | Responsibility |
| --- | --- | --- | --- |
| Cloudflare Workers | `@xid-kit/backend` | Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Node.js | `@xid-kit/backend` | Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Bun | `@xid-kit/backend` | Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Deno | `@xid-kit/backend` | Current package | Networkless JWT verification, request authentication, and webhook verification. |
| Go | `sdk/go` | Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Java | `sdk/java` | Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Rust | `sdk/rust` | Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| PHP | `sdk/php` | Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Ruby | `sdk/ruby` | Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| Python | `sdk/python` | Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |
| .NET | `sdk/dotnet` | Implemented · verified locally | Networkless JWT verification, request authentication, and webhook verification. |

## Client SDKs: web frameworks

| Framework | Package or directory | Status | Responsibility |
| --- | --- | --- | --- |
| Vanilla JS / Web | `@xid-kit/core` | Current package | Browser client, session store, token cache, and Management API helpers. |
| React | `@xid-kit/react` | Current package | Provider, hooks, control components, user UI, and organization UI. |
| Next.js | `@xid-kit/nextjs` | Current package | Middleware, App Router helpers, Pages Router helpers, and React re-exports. |
| Vue | `@xid-kit/vue` | Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Nuxt | `@xid-kit/nuxt` | Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Svelte / SvelteKit | `@xid-kit/svelte` | Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Angular | `@xid-kit/angular` | Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Remix | `@xid-kit/remix` | Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| Astro | `@xid-kit/astro` | Current package | Provider, hooks or composables, and prebuilt user and organization components. |
| SolidJS | `@xid-kit/solid` | Current package | Provider, hooks or composables, and prebuilt user and organization components. |

## Client SDKs: mobile

| Platform | Package or directory | Status | Responsibility |
| --- | --- | --- | --- |
| React Native | `@xid-kit/react-native` | Current package | Hosted redirect, deep link callback, PKCE S256, and secure storage adapter contract. |
| Expo | `@xid-kit/expo` | Current package | Expo Router integration, AuthSession, and SecureStore adapter. |
| Flutter | `sdk/flutter` | Implemented · verified locally | Hosted redirect, app link callback, and secure storage adapter. |
| iOS | `sdk/ios` | Implemented · verified locally | ASWebAuthenticationSession, Keychain storage, and PKCE S256. |
| Android | `sdk/android` | Implemented · verified locally | Custom Tabs, App Links, Keystore-backed storage, and PKCE S256. |

## Client SDKs: desktop

| Platform | Package or directory | Status | Responsibility |
| --- | --- | --- | --- |
| macOS | `sdk/macos` | Implemented · verified locally | ASWebAuthenticationSession, Keychain storage, and PKCE S256. |
| Windows | `sdk/windows` | Implemented · verified locally | WebView2 redirect, DPAPI secure storage, and PKCE S256. |
| Linux | `sdk/linux` | Implemented · verified locally | System browser redirect, Secret Service storage, and PKCE S256. |
| Electron | `@xid-kit/electron` | Current package | Main and renderer bridge, safeStorage, and loopback or custom scheme callbacks. |
| Tauri | `@xid-kit/tauri` | Current package | Rust backend bridge, OS keychain, and PKCE S256. |

## Shared native contract

- Native public clients use authorization code with PKCE S256. Implicit flow and password grant are not supported.
- Redirect callbacks are claimed app links, universal links, custom schemes, or platform equivalent callback URLs.
- Storage adapters keep refresh tokens or session cache values in platform secure storage and never store client secrets.
- JS and TS native SDKs (React Native, Expo) use a React provider plus hooks model: XidProvider, useSignIn, and useSignOut.
- Other native SDKs (iOS, Android, Flutter, desktop) use a functional configure, signIn, and handleRedirect API surface.

## Package guides

Each SDK has a dedicated reference page with install steps, API tables, and copy-paste examples. The SDK packages group in the sidebar lists every reference page; the most used web packages are:

- [@xid-kit/core](/sdks/core) — browser session, tokens, Management API helpers.
- [@xid-kit/backend](/sdks/backend) — networkless JWT verify, request auth, webhooks.
- [@xid-kit/react](/sdks/react) — provider, hooks, control and UI components.
- [@xid-kit/nextjs](/sdks/nextjs) — middleware and App/Pages Router server helpers.
- [@xid-kit/react-native](/sdks/react-native) — Hosted Auth redirect, PKCE S256, secure token storage for native apps.

Source: https://xid.dev/sdks/index.mdx