Anton Minin Baranovskii

Posted on Mar 7

Instant Access for Users, Fast Integration for Developers

#backend #authentication #security #architecture

Access infrastructure often becomes one of the most complex parts of a product.

Over time this layer grows into a large subsystem that becomes increasingly difficult to modify safely.

At the same time every new product still needs a reliable way to provide access.

This leads to a practical engineering question:

How can access be implemented without building a large authentication system inside the product?

Toqen.app was designed with a simple goal:

Instant access for users
Fast integration for developers

Instead of implementing authentication infrastructure inside the product, the product connects to an access layer through a lightweight SDK.

From the product’s perspective the integration is intentionally minimal.

In most cases it requires only two things:

Install and connect the SDK
Store the minimal user record required by the product

Everything related to access infrastructure is handled by the access layer.

This means the product team does not need to implement:

login flows
session infrastructure
cryptographic verification
abuse-prevention mechanisms

In practice the basic integration typically takes around 10 minutes.

Development Mode

The SDK includes a development mode designed for extremely fast local setup.

In development environments the SDK runs with a built-in in-memory store.

This allows the access flow to work immediately without configuring any database.

Developers can start building product features right away while the access layer is already functioning.

Moving to Production

When the product is ready for production, the product stores its user data in its own database.

At this stage the product typically keeps a minimal user record such as:

an internal user identifier
product-specific data
optional profile information

The SDK documentation provides clear step-by-step guides for connecting existing databases without redesigning the product architecture.

What the Integration Looks Like

A simplified example might look like this:

npm install @toqenapp/sdk

import { createToqen } from "@toqenapp/sdk"

const toqen = createToqen({
  siteKey: "SITE_KEY",
  mode: "development",
  callbacks: {
    onLogin,
    onLogout
  }
})

app.use(toqen.middleware())

app.get(
  "/dashboard",
  toqen.authorize(),
  (req, res) => {
    res.send("Protected content")
  }
)

app.get(
  "/profile",
  toqen.authorize(),
  async (req, res) => {

    const user = await db.users.findById(req.toqen.userId)

    res.send(user)

  }
)

What the SDK Does

toqen.middleware()

checks the access cookie
validates the signature
decodes claims
adds the access context to req.toqen

toqen.authorize()

checks for valid access
returns 401 if access is not present

Reliability and Responsibility

The architecture separates responsibilities clearly.

Toqen.app handles

access infrastructure
access sessions
security mechanisms around access

The product handles

its own database
business logic
product functionality

Security updates and improvements to the access infrastructure are maintained by the Toqen.app platform.

This allows product teams to avoid maintaining complex authentication systems inside their own codebase.

Why This Matters

For engineering teams this means:

extremely fast initial integration
predictable architecture
less security-sensitive code inside the product
fewer infrastructure components to maintain

Teams can focus on building product functionality instead of maintaining authentication infrastructure.

Pilot Integrations

We are currently opening pilot integrations for Toqen.app.

The goal is simple:

demonstrate how access infrastructure can remain lightweight while still providing secure and reliable access.

If you are interested in exploring the approach or testing the integration in your environment, feel free to reach out.

DEV Community