Backend-for-Frontend for SPAs using Authagonal. Runs the OIDC auth-code + PKCE flow server-side, holds tokens in a server-side session, and exposes the browser only an httpOnly cookie. Express + Next.js adapters.

AG-UI-compatible TypeScript client for the Surogates public-website channel. Wraps the publishable-key bootstrap, HttpOnly cookie, CSRF double-submit, and SSE streaming behind a standard AbstractAgent so widgets built for AG-UI work out of the box.

UserKit for the Next.js App Router: route handlers that keep the session in an httpOnly cookie, server-side session reads, and a route guard.

BFF-pattern OAuth handlers: sealed HttpOnly-cookie sessions + login/callback/refresh/logout route factories, built on Web-standard Request/Response so they drop into Nitro, Next.js route handlers, Cloudflare Workers, or plain Node (via a small adapter).

MyBid SSO client surface: session read via /v1/me, refresh + logout gateway calls, sign-in/up URL builders. HttpOnly cookie model — never stores or writes tokens itself.

Parses set-cookie headers into objects

Universal cookies for JavaScript

Middleware for Express.js for setting HttpOnly cookie and get access to existance of this cookie

hint for best practices related to the usage of the Set-Cookie response header.

Cookies, optionally signed using Keygrip.

Super lightweight cookie parser and serializer

Package for operating with Netscape HTTP Cookie File

Check if a URL is absolute

HTTP server cookie parsing and serialization

Provides middleware for stateless Bearer token authentication for Express JS. Uses a HttpOnly cookie.

RFC6265 Cookies and Cookie Jar for node.js

Sign and unsign cookies

A simple, lightweight JavaScript API for handling cookies

<!-- automd:badges bundlejs packagephobia codecov -->

simple persistent cookiejar system