The session token

import { bankroll } from "@joinbankroll/sdk";

const token = await bankroll.session();

const token = await bankroll.session({ identity: true });
// resolves only for a verified user — session.user.identity is truthy

import { withBankrollToken } from "@joinbankroll/sdk";

const appFetch = withBankrollToken(fetch);
await appFetch("/api/session", { method: "POST" });

import { verifyToken } from "@joinbankroll/sdk/server";
import { BANKROLL_TOKEN_HEADER } from "@joinbankroll/sdk";

const session = await verifyToken(req.headers.get(BANKROLL_TOKEN_HEADER), {
  audience: "https://acme.example", // your app's exact origin
});
if (!session) {
  return Response.json({ error: "unauthorized" }, { status: 401 });
}
// session.user.wallet is the user's stable id — bind it to your session.

// what verifyToken returns
interface BankrollSession {
  iss: string;         // issuer — always https://joinbankroll.com
  aud: string;         // your app's origin
  iat: number;         // issued-at (seconds)
  exp: number;         // expiry (seconds) — tokens are short-lived (~15 min)
  geo?: string;        // this session's region — 'US-NY' (ISO 3166-2) or 'US'
  user: {
    wallet: string;    // the user's wallet address — their stable id, and payout target
    username: string;  // the user's Bankroll handle — always present
    identity: { age?: number } | false; // verified ({} if no date of birth on file), or false
  };
}

const session = await verifyToken(token, { audience: MY_ORIGIN });
const canPlayRealMoney =
  session !== null &&
  session.user.identity !== false &&
  (session.user.identity.age ?? 0) >= 21 &&
  ALLOWED_REGIONS.has(session.geo ?? "");

import { bankroll, BankrollError } from "@joinbankroll/sdk";

try {
  const token = await bankroll.session();
  // ...verify server-side, sign the user in
} catch (e) {
  if (e instanceof BankrollError && e.code === "consent_declined") {
    showConnectPrompt(); // let them try again
    return;
  }
  throw e;
}