Registry / auth-security / toctoc-auth

toctoc-auth

JSON →
library1.1.9jsnpmunverified

TocToc Auth (v1.1.9) is a React authentication library with JWT access/refresh token lifecycle, encrypted local storage (AES-256-CBC, PBKDF2, HMAC), browser fingerprinting, and automatic token refresh with exponential backoff. Built for React 19, it ships TypeScript types and integrates via context providers and hooks. Differentiators include refresh deduplication, environment-aware logging, input sanitization, and open redirect protection. Released under active development.

npm install toctoc-auth
INSTALL
IMPORT
SIG · TOCTOC-AUTH
T
toctoc-auth
auth-securityjavascriptv1.1.9
harness data pending
Install & Compatibility
Where this runs

No compatibility data collected yet for this library.

Code
Verified usage

Verified import paths — ran on the pinned version, not inferred.

TocTocAuthProvider
import { TocTocAuthProvider } from 'toctoc-auth'
import TocTocAuthProvider from 'toctoc-auth'
Named export, not default. Since v1.0.
useTocTocAuth
import { useTocTocAuth } from 'toctoc-auth'
Hook must be used inside a TocTocAuthProvider context. Named export.
isTokenExpired
import { isTokenExpired } from 'toctoc-auth'
import { isTokenExpired } from 'toctoc-auth/utils'
Utility function exported from main package. Not a subpath.

Minimal setup: wrap app with TocTocAuthProvider, then use useTocTocAuth hook for credentials-based sign-in.

import { TocTocAuthProvider, useTocTocAuth } from 'toctoc-auth'; import { BrowserRouter } from 'react-router-dom'; const authConfig = { apiBaseUrl: process.env.AUTH_API_URL ?? 'http://localhost:4000', encryptionKey: process.env.ENCRYPTION_KEY ?? 'default-dev-key-32chars!!', providers: { credentials: { signUpApiRoute: '/auth/register', signInApiRoute: '/auth/login', refreshTokenApiRoute: '/auth/refresh', signInAfterSignUp: false, redirectClientRoutes: { afterSignUp: '/dashboard', afterSignIn: '/dashboard', afterSignOut: '/login' }, signInJsonResponseAccessTokenLocation: ['accessToken'], signInJsonResponseRefreshTokenLocation: ['refreshToken'], signInJsonResponseUser: { location: ['user'], roleLocation: ['role'] } } } }; function App() { return ( <BrowserRouter> <TocTocAuthProvider config={authConfig}> <YourApp /> </TocTocAuthProvider> </BrowserRouter> ); } function LoginForm() { const { signInWithCredentialsAsync, isAuthenticating, user } = useTocTocAuth(); const handleSubmit = async (e: React.FormEvent) => { e.preventDefault(); const res = await signInWithCredentialsAsync({ email: 'a@b.com', password: 'secret' }); if (res.isSuccess) console.log('Logged in'); else console.error(res.responseBody); }; return ( <form onSubmit={handleSubmit}> <button disabled={isAuthenticating}>Sign In</button> </form> ); }
Debug
Known issues
gotchaPeer dependencies require React 19 and react-router-dom 7. Using older versions may cause runtime errors.
fix
Ensure package.json includes react@^19.0.0, react-dom@^19.0.0, react-router-dom@^7.0.0.
affects: >=1.0.0
gotchaEncryption key must be exactly 32 characters for AES-256. Using a different length silently degrades encryption.
fix
Set encryptionKey to a 32-character string in authConfig.
affects: >=1.0.0
gotchaWhen signInAfterSignUp is true, the sign-in endpoint must accept the same request body as sign-up. Mismatched fields cause auth failures.
fix
Align sign-in API to accept the same payload as sign-up, or set signInAfterSignUp to false.
affects: >=1.0.0
Errors
Common errors & fixes
Cannot read properties of undefined (reading 'signInWithCredentialsAsync')
Component not wrapped in TocTocAuthProvider, or useTocTocAuth called outside provider.
fix
Wrap the component tree with <TocTocAuthProvider config={...}> at the root.
TypeError: (0 , toctoc_auth.useTocTocAuth) is not a function
Default import instead of named import.
fix
Use import { useTocTocAuth } from 'toctoc-auth' instead of import useTocTocAuth from 'toctoc-auth'.
Upgrade
Version history
1.1.9latest on npm
Audit
Dependencies
reactrequiredPeer dependency for React components and hooks
react-domrequiredPeer dependency for DOM rendering
react-router-domrequiredPeer dependency for routing and protected routes
Agent activity
27 hits · last 30 days
node
24
OpenAI (training)
1
Resources
toctoc-auth — npm install toctoc-auth · libregistry