Angular SDK API Reference

Everything below is exported from @hawcx/angular. It wraps @hawcx/core and re-exports its state types (AuthState, CoreAuthResult, AuthMode, Method, DeviceInfo, AuthError, the step types, and the state guards) so you can import them from one place.

Providers

`provideHawcx(options)`

Sets up Hawcx for a standalone app: registers HawcxService, the HAWCX_CONFIG token, and provideHttpClient(withInterceptors([hawcxInterceptor()])) (unless interceptor: false). Returns EnvironmentProviders.

import { provideHawcx } from '@hawcx/angular';

provideHawcx({
  configId: 'YOUR_CONFIG_ID',
  tokenEndpoint: '/api/hawcx/exchange',
  // interceptor: { excludeUrls: [/^\/public/] },  // or `false` to disable
});

options is HawcxProviderOptions = HawcxConfig plus:

Property	Type	Description
`interceptor`	`HawcxInterceptorOptions \| false`	Options for the HTTP interceptor, or `false` to not register it.

`provideHawcxService(config)`

Registers only HawcxService (+ HAWCX_CONFIG) — no HttpClient or interceptor. Use when you manage HttpClient yourself. Returns Provider[].

providers: [
  provideHawcxService({ configId: 'YOUR_CONFIG_ID' }),
  provideHttpClient(withInterceptors([hawcxInterceptor()])),
]

`HawcxConfig`

Property	Type	Required	Description
`configId`	`string`	Yes	Your Hawcx Config ID
`apiBase`	`string`	No	Tenant API base URL (default `https://api.hawcx.com/v1`)
`timeout`	`number`	No	Request timeout in ms (default `10000`)
`tokenEndpoint`	`string`	No	Your backend endpoint; the SDK POSTs `{ code, code_verifier }` there
`debug`	`boolean`	No	Enable debug logging

`HawcxService`

@Injectable({ providedIn: 'root' }) — inject it to drive auth programmatically.

Observables

Stream	Type
`state$`	`Observable<AuthState>`
`completion$`	`Observable<CoreAuthResult \| null>` (core's `AuthResult` — carries `expiresAt`/`sessionToken`, not Angular's `AuthResult`)
`accessToken$`	`Observable<string \| null>`
`isAuthenticated$`	`Observable<boolean>`
`isLoading$`	`Observable<boolean>`
`error$`	`Observable<AuthError \| null>`
`stepType$`	`Observable<string \| null>`
`notice$`	`Observable<AuthNotice \| null>` (device-revocation & other server notices)

Methods

Method	Description
`start(identifier, flowType?, device?)`	Begin a flow (`signin` / `signup` / `account_manage`; auto-detects when omitted). → `Promise<AuthState>`
`selectMethod(methodId)`	Choose a method at the `select_method` step.
`submitCode(code)`	Submit an email/SMS OTP.
`submitTotp(code)`	Submit an authenticator code.
`submitPhone(phone)`	Submit a phone number (E.164) during SMS enrollment.
`resend()`	Resend the current OTP.
`cancel()`	Cancel the current flow.
`reset()`	Reset to idle (`void`).
`signOut()`	Clear the access token + stored session (`void`).
`startStepUp(identifier, startToken, device?)`	Begin a step-up (re-auth) flow.
`getStepUpReceipt()`	The step-up receipt to forward to your backend, or `null`.
`hasDeviceCredentials(identifier)`	Whether this browser has stored device-trust creds. → `Promise<boolean>`
`exchangeToken()`	POST `{ code, code_verifier }` to `config.tokenEndpoint`. → `Promise<TokenResponse>`
`completeAuth()`	Resolve the completed `AuthResult`. → `Promise<AuthResult>`
`setAccessToken(token)`	Set/clear the access token (`void`).

Synchronous getters mirror the observables: getState(): AuthState, getCompletion(): CoreAuthResult | null, getAccessToken(): string | null, isAuthenticated(): boolean.

Two AuthResult types

@hawcx/angular exports two AuthResult-shaped types — don't mix them up: completion$ / getCompletion() emit CoreAuthResult (@hawcx/core's result: authCode, expiresAt, codeVerifier?, sessionToken?), while completeAuth() and the <hawcx-auth> authSuccess output emit Angular's own AuthResult (authCode, codeVerifier?, tokens?, stepUpReceipt?).

Route guards

Functional guards (CanActivateFn factories):

import { authGuard, guestGuard } from '@hawcx/angular';

{ path: 'app',   canActivate: [authGuard({ redirectTo: '/login' })] }
{ path: 'login', canActivate: [guestGuard({ redirectTo: '/dashboard' })] }

Export	Signature	Default redirect
`authGuard(options?)`	`(options?: { redirectTo?: string }) => CanActivateFn`	`/login`
`guestGuard(options?)`	`(options?: { redirectTo?: string }) => CanActivateFn`	`/`
`isAuthenticated`	`CanActivateFn`	(ready-made `authGuard()`)
`isGuest`	`CanActivateFn`	(ready-made `guestGuard()`)

HTTP interceptor

`hawcxInterceptor(options?)`

HttpInterceptorFn factory. Attaches Authorization: Bearer <token> to outgoing requests and signs out on 401. Registered automatically by provideHawcx unless interceptor: false. defaultHawcxInterceptor is a ready-made instance.

provideHttpClient(withInterceptors([
  hawcxInterceptor({ excludeUrls: ['/public', /^https:\/\/cdn\./] }),
]));

HawcxInterceptorOptions:

Property	Type	Default	Description
`excludeUrls`	`(string \| RegExp)[]`	`[]`	URLs to skip: a string matches by substring (`url.includes(pattern)`), a `RegExp` by `.test()`
`signOutOn401`	`boolean`	`true`	Sign out automatically on a `401`
`headerName`	`string`	`'Authorization'`	Header to set
`tokenPrefix`	`string`	`'Bearer '`	Token prefix

Components

All standalone; import the ones you use. <hawcx-auth> is the drop-in that runs the whole flow; the rest are the individual UI pieces it composes, for custom layouts.

Selector	Component	Purpose
`hawcx-auth`	`HawcxAuthComponent`	Full drop-in flow. Inputs: `flowType` (required `AuthMode`), `identifier` (required), `autoStart` (=`true`), `autoExchangeToken` (=`true`), `startToken?`, `showCancelButton` (=`true`). Outputs: `authSuccess` (`AuthResult`), `authError` (`AuthError`), `cancelled`.
`hawcx-method-selector`	`MethodSelectorComponent`	Method chooser.
`hawcx-otp-input`	`OtpInputComponent`	Email/SMS OTP entry.
`hawcx-totp-setup`	`TotpSetupComponent`	TOTP enrollment (QR + backup codes) / entry.
`hawcx-phone-input`	`PhoneInputComponent`	Phone-number entry for SMS enrollment.
`hawcx-await-approval`	`AwaitApprovalComponent`	QR / push await-approval screen.

Angular-specific types

These are defined by @hawcx/angular (everything else it exports is re-exported from @hawcx/core — see the Web reference).

`StepUpReceipt`

Returned by HawcxService.getStepUpReceipt() — forward it to your backend to complete a step-up.

interface StepUpReceipt {
  authCode: string;
  codeVerifier?: string;
}

`AuthResult` (Angular)

Angular's own result type — emitted by completeAuth() and the <hawcx-auth> authSuccess output. Distinct from CoreAuthResult (which completion$ / getCompletion() emit — see the note under HawcxService).

interface AuthResult {
  authCode: string;
  codeVerifier?: string;
  tokens?: TokenResponse;      // set once exchangeToken() has run
  stepUpReceipt?: StepUpReceipt;
}

interface TokenResponse {      // returned by HawcxService.exchangeToken()
  access_token: string;
  refresh_token?: string;
  expires_in?: number;
  token_type?: string;
}

Others

Type	Shape / meaning
`AuthGuardOptions`	`{ redirectTo?: string }` — options for `authGuard` (default `/login`).
`GuestGuardOptions`	`{ redirectTo?: string }` — options for `guestGuard` (default `/`).
`CoreAuthResult`	Alias of `@hawcx/core`'s `AuthResult` (`{ authCode, expiresAt, codeVerifier?, sessionToken? }`), re-exported for convenience.

Injection tokens

Token	Type	Description
`HAWCX_CONFIG`	`InjectionToken<HawcxConfig>`	The resolved config (provided by `provideHawcx`/`provideHawcxService`).
`HAWCX_ACCESS_TOKEN`	`InjectionToken<string \| null>`	The current access token.

For the underlying state machine (AuthState variants, step types, device revocation), see the Web SDK API Reference. @hawcx/angular re-exports those @hawcx/core types, but not AuthNotice.

Angular SDK API Reference

On this page