Ship it.

terminal — check your toolchain

# Approved participant setup
[PRIVATE_BETA_INSTALL_INSTRUCTIONS_REDACTED]

frauthy.ts — create the application SDK contract

import { createFrauthy } from "[PRIVATE_BETA_PACKAGE_COORDINATE_REDACTED]";

export const frauthy = createFrauthy({
  provider: { issuer: "https://auth.alice.com", audience: "alice-web" },
  store: {
    kind: "spicedb",
    endpoint: process.env.SPICEDB_ENDPOINT!,
    token: process.env.SPICEDB_TOKEN!,
  },
});

route.ts — verify a session and decide access

import { resource } from "[PRIVATE_BETA_PACKAGE_COORDINATE_REDACTED]";
import { frauthy } from "./frauthy";

const session = await frauthy.session(request);
const portal = resource("portal", "alice");
if (!(await session.can("access", portal))) {
  return new Response("Forbidden", { status: 403 });
}

Site UI SDK — documentation bridge

import { DocumentationBridge } from "[PRIVATE_BETA_PACKAGE_COORDINATE_REDACTED]";

<DocumentationBridge
  heading="Go from example to contract"
  sdk={sdkReference}
  ui={uiCatalog}
  note="Runtime SDKs and UI SDKs solve different problems."
/>

src/provider.ts

import { createProvider, oryAdapter } from "[PRIVATE_BETA_PACKAGE_COORDINATE_REDACTED]";
import config from "../frauthy.config";

// One surface, any backend. Swap the adapter and nothing below changes:
//   betterAuthAdapter(auth, { issuer })   ← Better Auth
const provider = createProvider(oryAdapter({
  issuer: config.service.issuer,
  sdkUrl: process.env.ORY_SDK_URL!,   // Hydra admin → /admin/clients
  apiKey: process.env.ORY_API_KEY,
}));

// Register an app that will sign users in through you
const client = await provider.clients.register({
  name: "Alice Web",
  redirectUris: ["https://app.alice.com/callback"],
  scopes: ["openid", "profile", "email"],
});

// React to the whole auth lifecycle (audit, webhooks, authz sync)
provider.lifecycle.on((e) => log.info(e.type));

src/connect.ts

import { discover, connectTo } from "[PRIVATE_BETA_PACKAGE_COORDINATE_REDACTED]";
import config from "../frauthy.config";

// 1 — resolve Bob from the registry (or a direct issuer URL)
const bob = await discover("bob", { registry: config.registry.url });

// 2 — register a client against Bob via dynamic client registration
const client = await connectTo(bob, {
  redirectUri: "https://app.alice.com/cb/bob",
  scopes: ["openid", "read:files"],
});

// 3 — send the user through Code + PKCE (keep the verifier for the callback)
const { url, codeVerifier } = await client.authorizationUrl();
// ...on callback:
const tokens = await client.exchange(code, codeVerifier);

terminal — three tabs

# 1 · your provider (Ory — or `pnpm dev` for Better Auth)
$ ory tunnel http://localhost:3000

# 2 · local discovery registry
$ pnpm discovery
▸ Frauthy Discovery listening on http://localhost:8788

# 3 · authz engine — Ory Keto (or `spicedb serve --http-enabled`)
$ keto serve -c keto.yml

# publication access is provided to approved participants
[PRIVATE_BETA_INSTALL_INSTRUCTIONS_REDACTED]