Crate stackure 

Stackure is the Rust SDK for the Stackure authentication API.

Stackure provides passwordless B2B authentication. This SDK wraps the public API behind five free functions and a tower middleware.

Quickstart

Protect an axum app:

let app = app.layer(stackure::auth(APP_ID, &["can_approve_invoice"]));

APP_ID is the app’s UUID as registered in Stackure. The layer works in any tower stack — axum, tonic, or hyper.

Access the authenticated user inside a handler:

let user = stackure::user_from_request(parts);

Manual verification without middleware:

let result = stackure::verify(APP_ID, parts, &[]).await;
if result.authenticated {
    // use result.user
}

Send a magic-link email:

let response = stackure::send_magic_link("user@example.com", Some(APP_ID)).await;

Log the user out:

stackure::logout(parts)

Sign-in handoff

Stackure’s session cookie is scoped to the Stackure host and is never visible to your app. After a successful magic-link sign-in, Stackure hands the browser back to the app’s registered URL with a session_token, either as a POST form field or as a query parameter.

The auth layer consumes both automatically: it stores the token in a cookie on your own domain and redirects to the same URL with the parameter stripped, so the token does not linger in the address bar.

Session binding

Stackure binds each session to the browser’s user agent and IP address. Because the SDK validates from your server rather than the browser, it forwards the original User-Agent and X-Forwarded-For on every validation call. Your app must therefore see the real client IP: if it sits behind a proxy or CDN, ensure that layer sets X-Forwarded-For correctly.

Every request is validated against Stackure, so revoking a session takes effect immediately.

Content negotiation

The auth layer inspects the Accept header. Browser requests (Accept: text/html) redirect to the sign-in URL on 401. API requests (Accept: application/json) receive a JSON error body.

Configuration

The SDK has no configuration API. Point it at a non-production environment by setting the STACKURE_BASE_URL environment variable before the first call.

Retry-on-5xx (one retry after 500ms) and the 2-second request timeout are hard-coded. Timeouts are never retried.

Errors

Every function except verify returns StackureError. Match on the variant, or call StackureError::code for the same lowercase category string the other Stackure SDKs expose as .code.

Re-exports

pub use errors::StackureError;

pub use middleware::Auth;

pub use middleware::AuthLayer;

pub use middleware::auth;

pub use middleware::logout;

pub use middleware::user_from_request;

pub use middleware::verify;

pub use types::MagicLinkResponse;

pub use types::Session;

pub use types::User;

pub use types::VerifyError;

pub use types::VerifyResult;

Modules

errors

Stackure SDK error type.

middleware

Session verification and the tower authentication middleware.

types

Types returned by the Stackure SDK.

validation

Input validation for the Stackure SDK.

Constants

SESSION_COOKIE

Name of the session cookie the SDK reads and writes.

TOKEN_PARAM

Name of the sign-in handoff parameter Stackure sends back.

Functions

base_url

Resolve STACKURE_BASE_URL from the environment, else production.

send_magic_link

Send a passwordless sign-in email.

validate_session

Validate the request’s session against Stackure.