Authdog

Kotlin · Ktor

Authentication for Ktor

A session resolver, a requireAuth gate, and a logout handler for Kotlin/Ktor backends. Validate Authdog sessions on every call, on the same wire as the Node SDKs.

Start buildingRead the docs
Maven versionCI passing
One resolve() call
authdog.resolve(call) gives any route a typed AuthdogContext, cached on the call so it costs at most one userinfo lookup.
One enforcement point
authdog.requireAuth(call) rejects unauthenticated requests with 401 before your handler runs.
Key validated at boot
The key is parsed and checked against the trusted-host allowlist once at construction, so untrusted keys never reach the hot path.
Injectable HttpClient
The userinfo lookup takes a Ktor HttpClient you can swap out in tests.

Resolve the session

// Application.kt
val authdog = Authdog(System.getenv("PK_AUTHDOG"))

routing {
  get("/me") {
    val ctx = authdog.requireAuth(call) ?: return@get
  }
}

Gate routes on the call

// Routes.kt
get("/me") {
  val ctx = authdog.requireAuth(call) ?: return@get
  call.respond(ctx.user)
}

Idiomatic Ktor, not a framework

Everything Ktor apps need

A session resolver, a requireAuth gate, and a typed context, all wire-compatible with the rest of your Authdog stack.

01

Resolve the session on any call

authdog.resolve(call) returns a typed AuthdogContext with token, user, and isAuthenticated, caching the result on the call so a route reads it without boilerplate.

  • Typed AuthdogContext
  • Cached on the call
02

requireAuth gate

authdog.requireAuth(call) responds 401 and returns null for unauthenticated requests, so `?: return@get` halts the handler before it runs. This is the security boundary.

  • 401 before your handler
  • Halts with ?: return@get
03

Validated at startup

The Authdog constructor parses and validates the public key once, enforcing the trusted identity-host allowlist, so a malformed or untrusted key fails fast instead of at the first request.

  • Fails fast at boot
  • Trusted-host allowlist
05

Safe logout handler

authdog.logout(call) expires the session cookie with HttpOnly and SameSite=Lax and redirects to a redirect_uri sanitized against open redirects.

  • HttpOnly, SameSite=Lax
  • Open-redirect safe
06

Same wire as Node

It mirrors @authdog/express and @authdog/fastify on the wire, so one Authdog environment serves your Node and Kotlin services interchangeably.

  • One environment
  • Node and Kotlin together
01

Add the dependency

Pull com.authdog:authdog-ktor from Maven Central.

02

Construct

Instantiate Authdog with your environment's public key.

03

Gate routes

Call requireAuth(call) in the handlers you protect.

Add auth to your Ktor app.

Add the dependency, resolve the session, and gate your routes with requireAuth today. Free to start, with secure defaults built in.

Start Building