\n\n# Clerk Backend Core SDK\n\n_Core Clerk API resources and authentication utilities for JavaScript environments._\n\n```diff\n! This package provides low-level utilities and is mostly used as the base for other Clerk SDKs.\n```\n\n## Usage\n\n```sh\nnpm install @clerk/backend-core\n# or\nyarn add @clerk/backend-core\n```\n\n## Architecture\n\n`@clerk/backend-core` contains all the logic for basic Clerk functionalities such as:\n\n- Determining the authentication state of a session.\n- Validating a Clerk token state.\n- Clerk API resource management.\n\nwithout being platform/environment specific.\n\n### How it works\n\nThis package is used as the base building block for Clerk JavaScript SDKs and environments. This is achieved by providing all the required business logic if only a few environment-specific utilities are implemented by the client.\n\n
\n\nIn essence, the client should supply these key functions in the Clerk [Base](./src/Base.ts#47) and [ClerkBackendAPI](./src/api/ClerkBackendAPI.ts) classes:\n\n1. Public key import `importKeyFunction`.\n2. JWT signature verification `verifySignatureFunction`.\n3. Base64 decoding `decodeBase64Function`.\n4. HTTP fetching utility for the API resource management `ClerkFetcher`.\n\nAfter supplying those in the `Base` and `ClerkBackendAPI` classes, you can use all the Clerk utilities required for the SDK business logic.\n\n### Creating a Base for a new SDK\n\n```ts\nconst importKey = async (jwk: JsonWebKey, algorithm: Algorithm) => {\n // ...\n};\n\nconst verifySignature = async (\n algorithm: Algorithm,\n key: CryptoKey,\n signature: Uint8Array,\n data: Uint8Array\n) => {\n // ...\n};\n\nconst decodeBase64 = (base64: string) => {\n // ...\n};\n\n/** Base initialization */\n\nconst examplePlatformBase = new Base(importKey, verifySignature, decodeBase64);\n```\n\nAfter creating the `Base` instance you can use core functions such as:\n\n```ts\nexamplePlatformBase.verifySessionToken(...);\n\nexamplePlatformBase.getAuthState(...);\n```\n\nThe `Base` utilities include the building blocks for developing any extra logic and middleware required for the target platform.\n\n### Validate the Authorized Party of a session token\nClerk's JWT session token, contains the azp claim, which equals the Origin of the request during token generation. You can provide a list of whitelisted origins to verify against, during every token verification, to protect your application of the subdomain cookie leaking attack. You can find an example below:\n\n```ts\nconst authorizedParties = ['http://localhost:3000', 'https://example.com']\n\nexamplePlatformBase.verifySessionToken(token> { authorizedParties });\n```\n\n### Clerk API Resources\n\nAPI resource management is also provided by this package through the [ClerkBackendAPI](./src/api/ClerkBackendAPI.ts) class. For more information on the API resources you can checkout the [resource documentation page](https://docs.clerk.dev/reference/backend-api-reference).\n\nTo use the Clerk Backend API wrapper in any JavaScript platform, you would need to provide some specific SDK information and an HTTP fetching utility. See more at the [ClerkBackendAPIProps](./src/api/ClerkBackendAPI.ts#17) implementation.\n","gitHead":"31563a57cce5e8ae3173923e7a8d3289bddf9928","license":"MIT","scripts":{"test":"jest","build":"tsc -p tsconfig.esm.json && tsc -p tsconfig.cjs.json && ./moduleTypeFix"},"_npmUser":{"name":"sokratis","email":"sokratis.vidros@gmail.com"},"homepage":"https://clerk.dev/","deprecated":"This package has been deprecated - use @clerk/backend instead","repository":{"url":"git+https://github.com/clerkinc/javascript.git","type":"git"},"_npmVersion":"lerna/4.0.0/node@v16.13.0+x64 (darwin)","description":"
![](\"https://images.clerk.dev/static/clerk.svg\")
\n \n ![](\"https://images.clerk.dev/static/backend_api_architecture.png\")
\n \n