Quickstart

Paste your token in the dashboard

If you haven’t already: in Console  go to RBAC → Members → Get API Token (MAT). Run transcodes install and paste it — saved to {{HOME_DIR}}/.transcodes/config.json. Treat it like a password.

Install transcodes-guard for your host

Pick your IDE and follow the host-specific guide — each uses a different native install mechanism:

Node.js ≥ 20 required. On first run, approve the one-time hook trust prompt in your host.

Prompt your agent

What roles exist in my project? Show recent audit logs.
Before retiring a member, walk me through step-up verification.

When the agent calls a verified tool (e.g. retire_member) or a gated shell command, you complete biometric MFA on Transcodes Auth — the agent cannot bypass it.

Create a project in the Console

Go to app.transcodes.io , create an Authentication cluster, and register at least one member. You get a Project ID and optional member tokens from the Setup Wizard.

Add the SDK to your frontend

Add the CDN script from Console → Installation Guide. No auth backend and no UI to build — the SDK redirects the user to the hosted auth page.

<script
  defer
  src="https://cdn.transcodes.link/{PROJECT_ID}/webworker.js"
></script>

Trigger login (redirect)

Call redirectToSignIn() for a full-page redirect to Transcodes Auth. After MFA, the user returns to your redirectUri with ?sid=...; call handleSignInCallback() on that page to exchange the sid for a JWT.

// Sign-in button — omit redirectUri to use the current page URL as callback
transcodes.redirectToSignIn();
 
// App bootstrap on the return page (run once on load)
const result = await transcodes.handleSignInCallback();
if (result.success) {
  // logged in — JWT stored in IndexedDB by the SDK
}

redirectToSignIn returns void (fire-and-forget). handleSignInCallback returns { success, payload, error? }; with no ?sid= in the URL it resolves success: false (safe to ignore on normal pages).

Wire step-up for sensitive actions

Before a dangerous action, await redirectToStepUp({ resource, action }) while the user is logged in (SDK Bearer token required). The backend returns decision: allow, deny, or stepup. For stepup, the SDK opens Transcodes Auth in a new tab, shows a waiting overlay on your page, and polls until verified.

const res = await transcodes.redirectToStepUp({
  resource: 'members',
  action: 'delete', // 'create' | 'read' | 'update' | 'delete'
});
const gate = res.payload[0];
const ok =
  res.success &&
  (gate?.decision === 'allow' ||
    (gate?.decision === 'stepup' && gate?.status === 'verified'));
if (ok) {
  // allowed or step-up verified — run the sensitive action
}

deny also returns success: true with payload[0].decision === 'deny' — check decision, not success alone.

Let users manage their own methods

redirectToConsole() opens the self-service page on Transcodes Auth where users add or remove passkeys, security keys, and TOTP — no UI for you to build. Returns void (fire-and-forget); if the member is not signed in, the SDK logs an error and does nothing. Details: Console.

transcodes.redirectToConsole();

Verify JWT on your server

Fetch the project’s public JWK and verify tokens with ES256 (not RS256). See JSON Web Key.