Welcome to CoreSDK

CoreSDK is a universal security engine — one SDK for every language — that gives any service enterprise-grade auth, fine-grained policy, distributed tracing, and multi-tenancy. Embed it as a library in Rust, Python, Go, TypeScript, or Java. No infrastructure to run, no sidecar required.

What does it do?

Capability	What you get
Auth	JWT/OAuth 2.0 verification, RBAC, session management
Policy	OPA-compatible Rego engine with hot-reload and audit log
Observability	OTEL spans, structured logs, RFC 9457 errors
Multi-tenancy	Hard tenant isolation, per-tenant policy namespaces

Pick your language

Rust

cargo add coresdk-engine

Python

pip install coresdk

Go

go get github.com/coresdk-dev/sdk-go

TypeScript

npm i @coresdk/node

How it works

CoreSDK runs in-process — it's a library, not a sidecar. Your service handles a request, the SDK middleware intercepts it, verifies the JWT, evaluates your Rego policy, starts an OTEL span, and calls your handler. The whole thing adds less than 0.3ms to your p99.

Request → [CoreSDK middleware] → Your handler → Response
              │
              ├─ verify JWT (JWKS cached)
              ├─ evaluate Rego policy
              ├─ start OTEL span + baggage
              └─ emit structured log

Not a black box

Every decision is observable. Every auth outcome, policy evaluation, and error is:

Written to a structured log with trace_id
Included in the OTEL span as attributes
Streamable to your SIEM via the audit log API

Introduction