Add SaaS Features in Minutes

// Start Plan:
{
  "api_calls": 10000,
  "storage_gb": 50,
  "team_members": 10,
  "features": ["advanced_analytics", "api_access", "priority_support"]
}

# npm
npm install @sassy/server

# yarn
yarn add @sassy/server

# pnpm
pnpm add @sassy/server

import { Sassy } from '@sassy/server';

const sassy = new Sassy({
  apiUrl: 'https://your-sassy-instance.com',
  publicKey: 'pk_live_xxxxx'  // From Developer Portal
});

// Express middleware example
async function authMiddleware(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];

  if (!token) {
    return res.status(401).json({ error: 'Unauthorized' });
  }

  try {
    const user = await sassy.verifyToken(token);
    req.user = user;
    next();
  } catch (err) {
    return res.status(401).json({ error: 'Invalid token' });
  }
}

// Use in your routes
app.get('/api/protected', authMiddleware, (req, res) => {
  res.json({ user: req.user });
});

┌─────────────────┐      ┌─────────────────┐      ┌─────────────────┐
│  Your Frontend  │ ──►  │   Your Server   │ ──►  │     Sassy       │
│  (Custom Auth   │      │ (Uses Server    │      │  (Auth Logic,   │
│   UI/Pages)     │      │  SDK)           │      │   Sessions)     │
└─────────────────┘      └─────────────────┘      └─────────────────┘

// Signup - create new user
app.post('/api/auth/signup', async (req, res) => {
  const result = await sassy.auth.signup({
    email: req.body.email,
    password: req.body.password,
    name: req.body.name,
  });

  res.json({
    accessToken: result.accessToken,
    refreshToken: result.refreshToken,
    user: result.user,
    tenantId: result.tenantId,
  });
});

// Login - authenticate user
app.post('/api/auth/login', async (req, res) => {
  const result = await sassy.auth.login({
    email: req.body.email,
    password: req.body.password,
  });

  res.json({
    accessToken: result.accessToken,
    refreshToken: result.refreshToken,
    user: result.user,
    memberships: result.memberships,
  });
});

// Refresh tokens
app.post('/api/auth/refresh', async (req, res) => {
  const result = await sassy.auth.refreshToken({
    refreshToken: req.body.refreshToken,
  });

  res.json({
    accessToken: result.accessToken,
    refreshToken: result.refreshToken,
  });
});

// Logout - invalidate refresh token
app.post('/api/auth/logout', async (req, res) => {
  await sassy.auth.logout(req.body.refreshToken);
  res.json({ success: true });
});

// Verify session - get full user/tenant/entitlements state
app.get('/api/auth/verify', async (req, res) => {
  const accessToken = req.headers.authorization?.replace('Bearer ', '');

  const session = await sassy.auth.verifySession({ accessToken });

  if (session.valid) {
    res.json({
      user: session.user,
      tenant: session.tenant,
      entitlements: session.entitlements,
    });
  } else {
    res.status(401).json({ error: session.reason });
  }
});

// Request password reset - always succeeds (doesn't reveal if user exists)
app.post('/api/auth/forgot-password', async (req, res) => {
  await sassy.auth.forgotPassword({ email: req.body.email });
  res.json({ message: 'If an account exists, a reset link has been sent.' });
});

// Reset password with token from email
app.post('/api/auth/reset-password', async (req, res) => {
  await sassy.auth.resetPassword({
    token: req.body.token,
    password: req.body.password,
  });
  res.json({ message: 'Password reset successfully' });
});

// Request magic link
app.post('/api/auth/magic-link', async (req, res) => {
  await sassy.auth.requestMagicLink({ email: req.body.email });
  res.json({ message: 'If an account exists, a magic link has been sent.' });
});

// Verify magic link token
app.post('/api/auth/verify-magic-link', async (req, res) => {
  const result = await sassy.auth.verifyMagicLink({ token: req.body.token });

  res.json({
    accessToken: result.accessToken,
    refreshToken: result.refreshToken,
    user: result.user,
  });
});

// Switch to a different tenant (for users with multiple tenants)
app.post('/api/auth/switch-tenant', async (req, res) => {
  const accessToken = req.headers.authorization?.replace('Bearer ', '');

  const result = await sassy.auth.switchTenant({
    accessToken,
    tenantId: req.body.tenantId,
  });

  res.json({
    accessToken: result.accessToken,   // New token scoped to target tenant
    refreshToken: result.refreshToken,
  });
});

import {
  ApiError,
  AuthenticationError,
  AccountLockedError,
  UserExistsError,
  InvalidInvitationError,
} from '@sassy/server-sdk';

app.post('/api/auth/signup', async (req, res) => {
  try {
    const result = await sassy.auth.signup({ ... });
    res.json(result);
  } catch (error) {
    if (error instanceof UserExistsError) {
      return res.status(409).json({ error: 'Email already registered' });
    }
    if (error instanceof AccountLockedError) {
      return res.status(429).json({ error: 'Account temporarily locked' });
    }
    if (error instanceof AuthenticationError) {
      return res.status(401).json({ error: 'Invalid credentials' });
    }
    res.status(500).json({ error: 'Internal server error' });
  }
});

// Get user by ID
const user = await sassy.users.get(userId);

// Get user with their plan and entitlements
const userWithPlan = await sassy.users.getWithPlan(userId);
console.log(userWithPlan.plan);        // { name: 'Pro', slug: 'pro', ... }
console.log(userWithPlan.entitlements); // { api_calls: 10000, ... }

// Update user's plan
await sassy.users.updatePlan(userId, 'enterprise');

// Check if user has a specific feature
const hasApiAccess = await sassy.entitlements.hasFeature(
  userId,
  'api_access'
);

if (!hasApiAccess) {
  return res.status(403).json({
    error: 'API access requires a Pro plan or higher'
  });
}

// Check numeric entitlement
const apiCallLimit = await sassy.entitlements.getValue(
  userId,
  'api_calls'
);
console.log(`User can make ${apiCallLimit} API calls`);

// Get all entitlements at once
const entitlements = await sassy.entitlements.getAll(userId);
// { api_calls: 10000, storage_gb: 50, features: [...] }

<!-- Include from your Sassy instance -->
<script src="https://your-sassy-instance.com/sdk.js"></script>

<script>
  const sassy = new SassySDK({
    publicKey: 'pk_live_xxxxx'
  });
</script>

import { SassySDK } from '@sassy/client';

const sassy = new SassySDK({
  apiUrl: 'https://your-sassy-instance.com',
  publicKey: 'pk_live_xxxxx'
});

// Request a magic link
async function requestMagicLink(email) {
  try {
    await sassy.auth.sendMagicLink(email);
    showMessage('Check your email for the login link!');
  } catch (err) {
    showError(err.message);
  }
}

// Handle the magic link callback (on page load)
async function handleAuthCallback() {
  const params = new URLSearchParams(window.location.search);
  const token = params.get('token');

  if (token) {
    try {
      await sassy.auth.verifyToken(token);
      window.location.href = '/dashboard';
    } catch (err) {
      showError('Invalid or expired link');
    }
  }
}

// Logout
async function logout() {
  await sassy.auth.logout();
  window.location.href = '/';
}

// Check if user is logged in
if (sassy.isAuthenticated()) {
  const user = sassy.getUser();
  console.log(`Welcome, ${user.name}!`);
}

// Get user's current plan
const plan = sassy.getPlan();
console.log(`You're on the ${plan.name} plan`);

// Check entitlements for UI
const entitlements = sassy.getEntitlements();
if (entitlements.features?.includes('advanced_analytics')) {
  showAnalyticsDashboard();
} else {
  showUpgradePrompt();
}

// Listen for auth state changes
sassy.onAuthStateChange((user) => {
  if (user) {
    updateUI(user);
  } else {
    showLoginScreen();
  }
});

┌─────────────────────────┐         ┌─────────────────────────┐
│     Sassy Server        │         │      Your Backend       │
│       (Authority)       │◄───────►│       (Enforcer)        │
├─────────────────────────┤         ├─────────────────────────┤
│ • User management       │         │ • App domain data       │
│ • Tenant management     │ Webhooks│ • Business logic        │
│ • Plans & entitlements  │ ───────►│ • Enforce entitlements  │
│ • Team invitations      │         │ • Credit metering       │
│ • JWT issuance & JWKS   │ JWT     │ • Validate tokens (JWKS)│
│ • Embedded control panel│ ───────►│ • Apply Sassy webhooks  │
└─────────────────────────┘         └─────────────────────────┘

import { webhookHandler } from '@sassy/server';

app.post('/webhooks/sassy',
  express.raw({ type: 'application/json' }),
  webhookHandler(),
  (req, res) => {
    const event = req.webhookEvent;

    switch (event.event_type) {
      case 'tenant.entitlements.updated':
        // Update local entitlements cache
        const { tenant_id, entitlements } = event.data;
        break;

      case 'membership.updated':
        // Update user role cache
        const { user_id, role } = event.data;
        break;

      case 'tenant.status.updated':
        // Handle status change (active, past_due, suspended)
        const { status } = event.data;
        break;
    }

    res.json({ received: true });
  }
);