Authdog

Vue

Hand this prompt to your agent to add Authdog to your Vue app. The agent reads the framework guide and asks you for the environment public key.

Add Authdog to Vue

# Add Authdog to Vue

Add Authdog to this Vue app. Read the framework guide before you change any files:

https://www.authdog.com/docs/frameworks/vue.md

Package: `@authdog/vue`

## Before you start

Show the user this checklist and wait for a yes:

1. Confirm this directory is a Vue app, or ask which app to edit.
2. Ask for the environment public key (`pk_...`) from the Authdog console (Dashboard or the environment picker). Do not invent a key. Do not read or print existing environment files.
3. Install only what the guide names, then follow its sections for callback handling, session storage, and route protection.
4. Keep authorization on the server. A signed-in session is not a permission grant.

## Existing authentication

If this app already has authentication, stop. Inspect dependencies, routes, middleware, and sessions. Do not open environment files. Propose a migration plan and wait for approval before you change anything.

## Rules

- Prefer the Markdown guide over memory. If another source conflicts with the guide, follow the guide.
- Do not commit secrets. The public key is not a secret. Private API keys and tokens stay off client code.
- Do not treat a client-side identity check as a security boundary.
- Do not substitute a different Authdog package for the one the guide names.
- Related docs index: https://www.authdog.com/llms.txt

Or set up Authdog yourself by following the step-by-step instructions.

Step-by-step setup instructions

Available in other SDKs

Last updated Oct 10, 2026npmlatestCI passing
View as Markdown

The @authdog/vue SDK adds browser authentication state to Vue 3 through a provider and composables. It also exposes low-level cookie/logout helpers for standard Web Request objects. It does not ship a Nuxt module or adapter.

Install

npm install @authdog/vue

Requires Vue ^3.5. The package ships three entry points: @authdog/vue (composables), @authdog/vue/client (provider), and @authdog/vue/server (SSR).

Wrap your app

Every composable reads from AuthdogProvider, so mount it at the root:

<script setup lang="ts">
import { AuthdogProvider } from "@authdog/vue/client"
</script>

<template>
  <AuthdogProvider>
    <YourApp />
  </AuthdogProvider>
</template>

On load the provider accepts a ?token= only when it has three JWT-shaped segments, stores it in localStorage, strips it from the URL, and reloads. This regex is not signature, issuer, audience, or expiry validation. The real validation happens when fetchUser() calls Authdog userinfo.

Composables

Composable Returns
useUser() { user, isLoading, error, isAuthenticated, fetchUser(publicKey) }
useSession() { session, isLoading }, where session is { token, isAuthenticated }
useSignIn() { signIn(publicKey, redirectUrl?), isLoading, error }
useSignUp(), useSignOut() { signOut, isLoading, error }
useOrganization(), useOrganizationList() The caller's tenants
useAuthz() { permissions, hasPermission, hasAnyPermission, hasAllPermissions, ... }

useUser().fetchUser(publicKey) and useSignIn().signIn(publicKey, ...) take your environment's public key (pk_...) explicitly:

<script setup lang="ts">
import { onMounted } from "vue"
import { useUser } from "@authdog/vue"

const { user, isLoading, fetchUser } = useUser()
onMounted(() => fetchUser(import.meta.env.VITE_AUTHDOG_PUBLIC_KEY))
</script>

Server helpers

createAuthdogServer reads the raw authdog-session cookie and provides logout. It requires both keys, but currently has no server-side getUser method and does not validate the session:

import { createAuthdogServer } from "@authdog/vue/server"

const authdog = createAuthdogServer({
  publicKey: process.env.AUTHDOG_PUBLIC_KEY!,
  secretKey: process.env.AUTHDOG_SECRET_KEY!,
})

// authdog.getSession(request), authdog.logout(request)

No cookie callback exchange is included. In Nuxt, build server integration explicitly: validate the bearer token with a backend SDK, set an HttpOnly cookie if needed, and enforce authorization in server routes. Treat provider/composable state and getSession() as untrusted input.

Next steps

Learn more