Wristband SDKs handle the integration work between your application and Wristband, such as starting the login flow, exchanging authorization codes for tokens, managing sessions, refreshing access tokens, and validating JWTs. The pages in this section explain what the SDKs do and how they behave, independent of any specific framework.

For step-by-step setup in a specific framework, see the Auth Quickstart.
For the full list of SDKs and links to their GitHub repositories, see Authentication SDKs.

📘
About Naming and Code Examples
Code examples and configuration field names in this section use the TypeScript-based SDKs. SDKs in other languages follow the same concepts, using the naming conventions of their respective language.

SDK Types

Wristband SDKs fall into five types, each with a distinct responsibility.

Backend Server Auth SDKs

Backend server auth SDKs handle user authentication for applications that follow the Backend Server Integration Pattern. They implement the server side of the login, callback, and logout flows, and include session management and auth middleware for protecting routes and APIs.

Available for: ASP.NET, Django, Express, FastAPI, Go, NestJS, Next.js

Frontend SDKs

Frontend SDKs run in the browser and pair with a backend server auth SDK. They call your backend server's Session Endpoint to initialize the user's auth state, can retrieve access tokens from your Token Endpoint, and redirect users to your Login and Logout Endpoints.

Available for: React

Session SDKs

Session SDKs provide encrypted cookie-based session management. The TypeScript Session SDK is embedded in the Express, Next.js, and NestJS auth SDKs, and it can also be used on its own, with or without Wristband authentication.

Available for: TypeScript

JWT Validation SDKs

JWT validation SDKs validate access tokens issued by Wristband for both user and machine authentication. They verify token signatures using keys from Wristband's JWKS endpoint, check the token's issuer and expiration, and return the decoded token payload when validation succeeds.

Available for: ASP.NET, Python, TypeScript

Machine-to-Machine (M2M) Auth SDKs

M2M auth SDKs retrieve, cache, and refresh access tokens for Wristband M2M OAuth2 clients using the Client Credentials grant type.

Available for: ASP.NET, Python, TypeScript

How the SDKs Fit Together

User Authentication

User authentication pairs a backend server auth SDK with a frontend SDK. The backend server auth SDK handles all communication with Wristband during login, callback, and logout, and stores the resulting tokens in the application session. The frontend SDK communicates only with your backend server's auth endpoints.

SDK Type	Runs In	Responsibility
Backend Server Auth SDK	Backend server	Login, callback, and logout flows; session management; token refresh; route and API protection
Frontend SDK	Browser	Initializing auth state from the Session Endpoint; retrieving tokens from the Token Endpoint; redirecting to the Login and Logout Endpoints

Machine Authentication

Machine authentication pairs an M2M auth SDK with a JWT validation SDK. The calling service uses the M2M auth SDK to obtain an access token and sends it as a Bearer token. The receiving API uses the JWT validation SDK to verify that token.

SDK Type	Runs In	Responsibility
M2M Auth SDK	Calling service	Retrieving, caching, and refreshing access tokens
JWT Validation SDK	Receiving API	Extracting and validating Bearer tokens

In This Section

User Authentication: How the backend server auth SDKs and frontend SDKs handle configuration, auth endpoints, login, callback, logout, sessions, token refresh, route protection, and CSRF protection.
Machine Authentication: How the M2M auth SDKs retrieve, cache, and refresh access tokens.
JWT Validation: How the JWT validation SDKs verify Wristband-issued access tokens.