Skip to content
Ownfold
Esc
↑↓navigate↵open⌘Jpreview
On this page

Backend SDK overview

Use Ownfold from API servers, workers, jobs, and service applications without React, a browser SDK, or any Ownfold-hosted service.

Ownfold is not a frontend-only SDK. Its backend packages can be used from an API-only application, a worker, a scheduled job, or a service that never renders a page. React and @ownfold/browser are optional leaf integrations.

Choose a backend mode

Mode Install Plaintext location Use when
Ciphertext coordination @ownfold/server plus framework, auth, and database adapters Never reaches the backend A client owns encryption keys and your API coordinates vault metadata.
Trusted backend encryption @ownfold/core and @ownfold/crypto Exists briefly in your backend process Your service intentionally owns encryption and decryption.
Contracts and validation only @ownfold/core Determined by your application You need formats, parsers, errors, or adapter interfaces.

These modes can be used independently. A backend coordination service does not import a browser package. A trusted encryption worker does not need an HTTP or database adapter.

Backend package map

Concern Package What it provides
Domain contracts @ownfold/core Strict parsers, tagged errors, encrypted formats, and adapter interfaces.
Cryptography @ownfold/crypto Root keys, record encryption, Recovery Kits, device envelopes, and key rewrapping.
Coordination @ownfold/server Authenticated vault, recovery, device, pairing, and rotation operations.
Web HTTP @ownfold/fetch A framework-neutral Request => Response handler and bounded JSON utilities.
Node HTTP @ownfold/node Node.js and Express bridges for the Web handler.
Frameworks @ownfold/next, @ownfold/fastify, @ownfold/hono, @ownfold/elysia, @ownfold/trpc Thin server-framework adapters.
Authentication @ownfold/better-auth, @ownfold/auth-js Stable user-ID resolvers for existing session systems.
Databases @ownfold/sqlite, @ownfold/postgres, @ownfold/drizzle, @ownfold/prisma Vault coordination storage adapters.
Testing @ownfold/testing In-memory adapters, fixtures, and reusable compliance suites.

What the coordination server does

VaultServer authorizes every operation through your session system and persists coordination metadata through your selected adapter. It manages:

  • vault metadata and Recovery Kit verification state;
  • device registration, activity, and revocation;
  • device-pairing requests and approvals;
  • resumable root-key rotation state; and
  • strict validation of application-owned encrypted-record writes.

It deliberately has no application-record decryption method. Your backend stores encrypted application records in its own tables and can reject envelopes whose owner, namespace, record ID, vault ID, or key version does not match the authenticated request.

No frontend dependency

This is a complete backend dependency set for an Express and SQLite service:

pnpm add @ownfold/fetch@beta @ownfold/node@beta @ownfold/server@beta @ownfold/sqlite@beta express

It does not install React, @ownfold/react, @ownfold/browser, IndexedDB code, or UI components. Continue to the backend quickstart for a complete server, or use trusted backend encryption when the server itself should own the keys.

Runtime support

Runtime Recommended integration Notes
Node.js 22.13+ @ownfold/node, Fastify, Next.js, or tRPC Direct SQLite and PostgreSQL adapters are supported.
Bun Elysia or the Web-standard Fetch handler Choose a database driver compatible with Bun.
Deno Web-standard Fetch handler Use a runtime-native adapter implementing the Ownfold storage contracts.
Cloudflare Workers Hono or Fetch handler Node database drivers and node:sqlite are unavailable.

Runtime support for a framework does not imply support for every database or authentication library in that runtime. Each adapter page states its own requirements.

Next steps

Last updated on August 4, 2026

Was this page helpful?