Auth Apps SDK — Cliodot Documentation

For Node.js and TypeScript projects, Cliodot provides an optional SDK in the cliodot npm package (v1.2.6+). AuthAppClient wraps the /auth endpoints documented above.

AuthAppClient is for runtime MFA integration only. It does not manage the main Cliodot application, portal settings, delivery templates, message templates, or webhooks.

Install#

npm install cliodot

Client setup#

import { AuthAppClient } from "cliodot";

const client = new AuthAppClient({
 baseUrl: "https://api.example.com",
 appId: "auth_app_507f1f77bcf86cd799439011",
 appApiKey: "YOUR_APP_API_KEY",
 // appSecret: "as_...",  // alternative to appApiKey
});

Config	Required	Purpose
`baseUrl`	yes	Public API origin (no trailing slash). SDK calls `{baseUrl}/auth/...`
`appId`	yes	Auth app `_id` from the portal
`appApiKey`	no*	Sends `Authorization: Bearer aak_...`
`appSecret`	no*	Sends `X-Cliodot-App-Id` + `X-Cliodot-App-Secret`

\* One of appApiKey or appSecret is required.

Runtime methods#

await client.users.upsert("user_123", { email: "user@example.com", phone: "+14155550100" });

await client.mfa.status("user_123");

await client.mfa.totp.enroll("user_123", { label: "user@example.com" });
await client.mfa.totp.confirm("user_123", "123456");
await client.mfa.totp.verify("user_123", "654321");
await client.mfa.totp.disable("user_123");
await client.mfa.totp.reset("user_123", { label: "user@example.com" });

await client.mfa.recoveryCodes.generate("user_123");
await client.mfa.recoveryCodes.verify("user_123", "YOUR_RECOVERY_CODE");

await client.providers.emailOtp.enroll("user_123", { email: "user@example.com" });
await client.providers.emailOtp.challenge("user_123", { email: "user@example.com" });
await client.providers.emailOtp.resend("user_123", { email: "user@example.com" });
await client.providers.emailOtp.verify("user_123", "123456");
await client.providers.emailOtp.disable("user_123");
await client.providers.emailOtp.status("user_123");

await client.providers.smsOtp.enroll("user_123", { phone: "4155550100", phone_country_code: "US" });
await client.providers.smsOtp.verify("user_123", "123456");
const smsStatus = await client.providers.smsOtp.status("user_123");

await client.providers.magicLink.enroll("user_123", { email: "user@example.com" });
await client.providers.magicLink.verify("user_123", "base64url-token-from-link");
await client.providers.magicLink.status("user_123");

Public magic-link verify (no SDK auth headers — call from your frontend or use fetch):

const res = await fetch(`${baseUrl}/auth/apps/${appId}/magic-link/verify`, {
 method: "POST",
 headers: { "Content-Type": "application/json" },
 body: JSON.stringify({ token }),
});

Related resources: AUTH_APPS_API_SAMPLES.json