Auth

If your miniapp has its own backend, session.auth lets you call it as the current Glassly user, with no login screen. The host hands your miniapp a signed token; your backend verifies it and gets the user’s id. Two steps.

Get started

1. Call your backend from the miniapp

Use session.auth.fetch exactly like fetch. It attaches the user’s token for you.

src/background/index.ts

const res = await session.auth.fetch("https://api.example.com/notes");
const notes = await res.json();

2. Verify the token on your backend

Install @glassly/auth and add its middleware. The verified user lands on the request.

import { createAuthService, type AuthVariables } from "@glassly/auth";
import { Hono } from "hono";

const glasslyAuth = createAuthService({ packageName: "com.example.myapp" });

const app = new Hono<{ Variables: AuthVariables }>();
app.use("/api/*", glasslyAuth.hono());

app.get("/api/notes", (c) => {
  const { glasslyUserId } = c.get("glasslyAuth");
  return c.json({ userId: glasslyUserId });
});

That’s it. Every request to /api/* now arrives with a verified Glassly user id, and a token minted for another miniapp can’t be used against yours (its audience is pinned to your package).

On the client

session.auth.fetch(input, init) is the easy path. If you bring your own HTTP client, grab the header or token instead:

Method	Returns	Description
`fetch(input, init?)`	`Promise<Response>`	Standard `fetch` with the `Authorization` header added.
`getAuthHeader(options?)`	`Promise<string>`	The string `"Bearer <token>"`.
`getToken(options?)`	`Promise<string>`	The raw token.
`onUpdate(handler)`	`() => void`	Fires when the host rotates the token. Returns an unsubscribe function.

const header = await session.auth.getAuthHeader();
await axios.get("https://api.example.com/notes", { headers: { Authorization: header } });

The token rotates, so read it through fetch/getAuthHeader/getToken each time rather than caching the string. Those three take a minTtlMs option, the minimum lifetime the token must still have (default 30000); if the current token has less left, the call waits for the next refresh.

const res = await session.auth.fetch("https://api.example.com/sync", { minTtlMs: 120_000 });

session.auth.current holds the active token and who it’s for (or null before the host issues one). session.auth.glasslyUserId and session.auth.oemId are getter shortcuts.

Field	Type	Description
`glasslyUserId`	`string`	The Glassly user this token is for.
`oemId`	`string \| undefined`	The OEM that provisioned the user, when present.
`token`	`string`	The signed token sent to your backend.
`expiresAt`	`number`	Expiry as a Unix timestamp in milliseconds.

On your backend

createAuthService({ packageName }) checks the signature against GlasslyOS’s JWKS, the issuer, and the audience (your packageName), and rejects expired tokens. packageName can also come from the GLASSLY_PACKAGE_NAME environment variable. Not on Hono? Verify directly:

await glasslyAuth.verifyRequest(request);        // a Web Request
await glasslyAuth.verifyAuthHeader(headerValue); // an Authorization header value
await glasslyAuth.verifyToken(token);            // a bare token

Each resolves to a VerifiedAuth (or throws AuthError):

Field	Type	Description
`glasslyUserId`	`string`	The Glassly user (the JWT `sub`).
`tenantId`	`string?`	The tenant that provisioned the user, when present.
`packageName`	`string`	Your miniapp package (the verified audience).
`tokenId`	`string?`	The token’s `jti`, if set.
`expiresAt`	`number?`	`exp`, in Unix seconds.
`issuedAt`	`number?`	`iat`, in Unix seconds.
`claims`	`JWTPayload`	The raw verified claims.

Pointing at a non-production Core

By default it verifies against production Core’s JWKS (https://core.glassly.com/.well-known/jwks.json). For local, staging, or self-hosted Core, pass jwksUrl (or set GLASSLY_AUTH_JWKS_URL):

const glasslyAuth = createAuthService({
  packageName: "com.example.myapp",
  jwksUrl: "http://localhost:3000/.well-known/jwks.json",
});

Getting Started

Core Concepts

UI Layer

Display

Audio & Speech

Sensors & Input

Camera

Phone & System

Data

Reference

Get started

1. Call your backend from the miniapp

2. Verify the token on your backend

On the client

On your backend

Pointing at a non-production Core

​Get started

​1. Call your backend from the miniapp

​2. Verify the token on your backend

​On the client

​On your backend

​Pointing at a non-production Core

Get started

1. Call your backend from the miniapp

2. Verify the token on your backend

On the client

On your backend

Pointing at a non-production Core