Every auth library promises flexibility.Only one standardizes it.Pubflow IS the Trust Layer Standard.

// Manually validate JWT
// — exposed to alg confusion attacks
const decoded = jwt.verify(
  token,
  process.env.JWT_SECRET
);

if (!decoded) {
  return res
    .status(401)
    .json({ error: "Unauthorized" });
}

// ✗ No revocation — wait for expiry
// ✗ No device context captured
// ✗ One validation mode for all routes
// ✗ Client holds full JWT payload

// Bridge Validation — Trust Layer Standard
// session_id is opaque. Payload stays backend-only.
const session = await flowless.validate(
  session_id,
  {
    mode: "ADVANCED"   // +device fingerprint
    bridge_secret: env.BRIDGE_SECRET
  }
);

// ✓ Instant revocation — no expiry wait
// ✓ 97% cache hit rate  (<1ms validation)
// ✓ Per-route validation modes
// ✓ Client only holds opaque session_id