One identity boundary. No implicit trust.

let auth = SharedAuthClient::new(
    "https://gateway.example/shared-auth",
).with_service_credential(
    std::env::var("SHARED_AUTH_INTROSPECT_SECRET")?,
);

let identity = auth.introspect(access_token).await?;
if !identity.has_acr("urn:oresoftware:loa:2") {
    anyhow::bail!("step-up authentication required");
}

The service credential is sent only to /auth/introspect, never to exchange or factor requests.

const auth = new SharedAuthClient(
  "https://gateway.example/shared-auth",
).withServiceCredential(
  process.env.SHARED_AUTH_INTROSPECT_SECRET,
);

const identity = await auth.introspect(accessToken);
if (!identity.acr.includes("urn:oresoftware:loa:2")) {
  throw new Error("step-up authentication required");
}

TypeScript follows the same two-credential boundary and fails closed for sensitive operations.

final auth = SharedAuthClient(
  'https://gateway.example/shared-auth',
).withServiceCredential(introspectionSecret);

final identity = await auth.introspect(accessToken);
if (!identity.hasAcr('urn:oresoftware:loa:2')) {
  throw StateError('step-up authentication required');
}

The Dart package carries factor and passkey operations for mobile and web hosts.

let auth = try SharedAuthClient(
  baseURL: "https://gateway.example/shared-auth",
  serviceCredential: ProcessInfo.processInfo.environment[
    "SHARED_AUTH_INTROSPECT_SECRET"
  ]
)

let identity = try await auth.introspect(accessToken)
guard identity.hasACR("urn:oresoftware:loa:2") else {
  throw AssuranceError.stepUpRequired
}

Swift models WebAuthn credentials as opaque JSON so platform authenticators remain the biometric boundary.