Authentication you run yourself.

import { Authbase } from "@authbase/node";
import { requireAuth } from "@authbase/node/express";

const authbase = new Authbase({
  url: process.env.AUTHBASE_URL!,
  apiKey: process.env.AUTHBASE_API_KEY!,
});

app.post("/login", async (req, res) => {
  const tokens = await authbase.auth.login({
    identifier: req.body.email,
    password: req.body.password,
    client_ip: req.ip,
  });
  res.json(tokens);
});

// Verified locally against the app's JWKS
app.get("/me", requireAuth(authbase), (req, res) => {
  res.json({ id: req.auth!.sub, roles: req.auth!.roles });
});

val authbase = Authbase(
    url = System.getenv("AUTHBASE_URL"),
    apiKey = System.getenv("AUTHBASE_API_KEY"),
)

install(Authentication) { authbase { client(authbase) } }

routing {
    post("/login") {
        val c = call.receive<Credentials>()
        call.respond(authbase.auth.login(
            LoginRequest(identifier = c.email, password = c.password, clientIp = call.request.origin.remoteHost)
        ))
    }
    // Verified locally against the app's JWKS
    authenticate("authbase") {
        get("/me") { call.respond(call.authbase!!.subject) }
    }
}

# Your backend logs a user in with the app's API key
curl https://auth.example.com/v1/auth/login \
  -H "Authorization: Bearer $AUTHBASE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"identifier":"ada@example.com","password":"…","client_ip":"203.0.113.9"}'
# → { "access_token": "eyJ…", "refresh_token": "rt_…", "expires_in": 900, … }

# …and checks access tokens with any JWT library, against
curl https://auth.example.com/apps/cashmate/.well-known/jwks.json