{"ref":"artifact:sap-xssec","page":"/artifacts/sap-xssec","json":"/artifacts/sap-xssec.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"sap-xssec","name":"@sap/xssec","artifact_type":"package","ecosystem":"cap","domain":"operations-and-runtime","origin_ring":"sap-official","description":{"one_line":"Token validation and security context for XSUAA and IAS.","short":"Token validation and security context for XSUAA and IAS"},"links":{"npm":"https://www.npmjs.com/package/@sap/xssec","docs":"https://cap.cloud.sap/docs/"},"compat":{"runtimes":["node"]},"type_properties":{"distribution":{"value":["npm"],"sources":[{"url":"https://www.npmjs.com/package/@sap/xssec","title":"@sap/xssec — README","checked":"2026-10-18","quote":"npm i @sap/xssec"}]}},"provenance":{"discovered_via":[{"source":"source:npm"},{"source":"source:github","channel":"cap-js"}],"first_seen":"2026-08-31"},"source_available":false,"provides":["capability:authentication"],"requires":["artifact:btp-authorization-and-trust-management","artifact:btp-cloud-identity-services"],"connects":[{"ref":"artifact:btp-authorization-and-trust-management","kind":"authentication","protocols":["http"],"direction":"outbound","for":"Validating the JWT a request carries against the keys XSUAA publishes, and fetching tokens from it.","sources":[{"url":"https://unpkg.com/@sap/xssec@4.15.0/README.md","title":"@sap/xssec 4.15.0 — README","checked":"2026-09-19","quote":"This module allows Node.js applications to authenticate users via JWT tokens issued by [SAP Business Technology Platform (BTP)](https://www.sap.com/products/technology-platform.html) security services (SAP Cloud Identity Services and XSUAA). It also provides an API for fetching tokens from these services."},{"url":"https://unpkg.com/@sap/xssec@4.15.0/README.md","title":"@sap/xssec 4.15.0 — README, JWKS","checked":"2026-09-19","quote":"The application retrieves the JWKS via HTTP from the authentication server."},{"url":"https://unpkg.com/@sap/xssec@4.15.0/README.md","title":"@sap/xssec 4.15.0 — README, JWKS","checked":"2026-09-19","quote":"only URLs beginning with **https** scheme are supported for JWKS fetching."}]},{"ref":"artifact:btp-cloud-identity-services","kind":"authentication","protocols":["oidc","http"],"direction":"outbound","for":"Validating the JWT a request carries against Identity Authentication: the module reads the OIDC configuration from the tenant's `.well-known` endpoint and then its JWKS.","sources":[{"url":"https://unpkg.com/@sap/xssec@4.15.0/README.md","title":"@sap/xssec 4.15.0 — README, timeout","checked":"2026-09-19","quote":"this timeout value will be used for fetching the OIDC configuration from the `.well-known` endpoint as well as fetching the `JWKS`."},{"url":"https://unpkg.com/@sap/xssec@4.15.0/README.md","title":"@sap/xssec 4.15.0 — README, JWKS","checked":"2026-09-19","quote":"The application retrieves the JWKS via HTTP from the authentication server."}]}],"drafted_with_ai":true,"history":[{"date":"2026-09-19","field":"connects","from":null,"to":"btp-authorization-and-trust-management, btp-cloud-identity-services","reason":"@sap/xssec required both security services without saying what passes between them. The README states the calls: JWKS over https for both, and the OIDC configuration for Identity Authentication."}]},"effective_normative_relations":[],"readings":{"liveness":[{"label":"Maintenance","tier":"good","evidence":"3 months since release"},{"label":"Continuity","tier":"fair","evidence":"2 publishers on npm"},{"label":"Repository","tier":"unknown","evidence":"no repository data"}],"compatibility":[{"label":"Declared for","tier":"fair","evidence":"nothing declared"},{"label":"Survived majors","tier":"good","evidence":"released before and after @sap/cds 10"},{"label":"Maintainer's CI","tier":"unknown","evidence":"no repository data"}],"practice":[{"label":"Tests","tier":"unknown","evidence":"npm test script, tree not read"},{"label":"Docs","tier":"good","evidence":"docs site, README 60 KB"},{"label":"Changelog","tier":"fair","evidence":"none in the repo"}],"reach":[{"value":183639,"unit":"installs/week"},{"value":null,"unit":"watching"}]},"signals":{"crawled_at":"2026-10-26","latest_version":"4.15.0","majors":{"1":{"version":"1.1.1","date":"2020-06-11"},"2":{"version":"2.1.1","date":"2020-06-11"},"3":{"version":"3.0.3","date":"2020-06-11"},"4":{"version":"4.0.0","date":"2024-05-16"}},"license":"SAP DEVELOPER LICENSE AGREEMENT","first_release":"2020-06-11","last_release":"2026-08-10","releases":107,"cadence_days":28,"maintainers":2,"repository":null,"peer_cds":null,"test_script":true,"types":true,"downloads_weekly":183639,"months_since_release":3,"dormant":false,"repository_directory":null,"dependencies":2,"node_engine":">=18","downloads_monthly":1249005,"npm_document_version":"4.15.0","npm_document_integrity":"sha512-I9TMMaWq4BNDNt9blJy8o2FV9uXjs2RyNTT7KBv9fK83bGoQxcipQ8e4DrxYb296GXg+HhE420kHuqmyXZSOuQ==","npm_document_tarball":"https://registry.npmjs.org/@sap/xssec/-/xssec-4.15.0.tgz","readme_path":"README.md","readme_bytes":61530,"readme_source":"npm","changelog":false,"license_file":true,"license_path":"LICENSE","license_name":"SAP DEVELOPER LICENSE AGREEMENT 3.2"},"release_notes":{"license":"SAP DEVELOPER LICENSE AGREEMENT 3.2","quotable":true,"versions":[{"version":"4.15.0","date":"2026-08-10"},{"version":"4.13.3","date":"2026-07-13"},{"version":"4.13.1","date":"2026-07-01"},{"version":"4.13.0","date":"2026-03-17"},{"version":"4.12.2","date":"2026-01-15"},{"version":"4.12.1","date":"2025-12-12"},{"version":"4.12.0","date":"2025-12-09"},{"version":"4.11.2","date":"2025-11-11"},{"version":"4.11.1","date":"2025-11-07"},{"version":"4.11.0","date":"2025-10-23"},{"version":"4.10.0","date":"2025-09-23"},{"version":"4.9.2","date":"2025-09-15"},{"version":"4.9.1","date":"2025-08-07"},{"version":"4.9.0","date":"2025-07-14"},{"version":"4.8.0","date":"2025-06-04"},{"version":"4.7.0","date":"2025-05-07"},{"version":"4.6.0","date":"2025-04-09"},{"version":"4.5.0","date":"2025-03-24"},{"version":"3.6.2","date":"2025-03-14"},{"version":"4.4.0","date":"2025-02-14"},{"version":"4.3.0","date":"2025-02-12"},{"version":"4.2.8","date":"2025-01-14"},{"version":"4.2.7","date":"2024-11-08"},{"version":"4.2.6","date":"2024-10-18"},{"version":"4.2.5","date":"2024-10-16"},{"version":"4.2.4","date":"2024-09-05"},{"version":"4.2.3","date":"2024-09-04"},{"version":"4.2.2","date":"2024-08-29"},{"version":"4.2.1","date":"2024-07-25"},{"version":"4.2.0","date":"2024-07-22"},{"version":"4.1.3","date":"2024-06-28"},{"version":"4.1.2","date":"2024-06-21"},{"version":"4.1.1","date":"2024-06-19"},{"version":"4.1.0","date":"2024-06-13"},{"version":"4.0.4","date":"2024-06-12"},{"version":"4.0.3","date":"2024-06-06"},{"version":"4.0.2","date":"2024-06-05"},{"version":"4.0.1","date":"2024-06-03"},{"version":"4.0.0","date":"2024-05-16"},{"version":"3.6.1","date":"2023-12-22"},{"version":"3.6.0","date":"2023-11-24"},{"version":"3.5.0","date":"2023-11-15"},{"version":"3.4.0","date":"2023-10-24"},{"version":"3.3.5","date":"2023-09-29"},{"version":"3.3.4","date":"2023-09-06"},{"version":"3.3.3","date":"2023-08-08"},{"version":"3.3.2","date":"2023-07-28"},{"version":"3.3.0","date":"2023-07-24"},{"version":"3.2.18","date":"2023-07-14"},{"version":"3.2.17","date":"2023-01-20"},{"version":"3.2.15","date":"2023-01-09"},{"version":"3.2.14","date":"2022-10-12"},{"version":"3.2.13","date":"2022-02-15"},{"version":"3.2.12","date":"2022-01-19"},{"version":"3.2.11","date":"2021-11-30"},{"version":"3.2.10","date":"2021-11-03"},{"version":"3.2.9","date":"2021-10-22"},{"version":"3.2.8","date":"2021-10-18"},{"version":"3.2.7","date":"2021-09-15"},{"version":"3.2.5","date":"2021-09-07"},{"version":"3.2.4","date":"2021-09-06"},{"version":"3.2.3","date":"2021-08-23"},{"version":"3.2.2","date":"2021-06-17"},{"version":"3.2.1","date":"2021-06-02"},{"version":"3.2.0","date":"2021-04-20"},{"version":"3.1.2","date":"2021-03-02"},{"version":"3.1.1","date":"2021-02-11"},{"version":"3.1.0","date":"2021-02-10"},{"version":"3.0.10","date":"2020-10-02"},{"version":"3.0.9","date":"2020-08-06"},{"version":"3.0.8","date":"2020-08-06"},{"version":"3.0.7","date":"2020-07-24"},{"version":"3.0.6","date":"2020-07-01"},{"version":"3.0.5","date":"2020-06-26"},{"version":"3.0.3","date":"2020-06-11"},{"version":"3.0.2","date":"2020-06-11"},{"version":"3.0.1","date":"2020-06-11"},{"version":"3.0.0","date":"2020-06-11"},{"version":"2.2.5","date":"2020-06-11"},{"version":"2.2.4","date":"2020-06-11"},{"version":"2.2.3","date":"2020-06-11"},{"version":"2.2.2","date":"2020-06-11"},{"version":"2.2.1","date":"2020-06-11"},{"version":"2.2.0","date":"2020-06-11"},{"version":"2.1.17","date":"2020-06-11"},{"version":"2.1.16","date":"2020-06-11"},{"version":"2.1.15","date":"2020-06-11"},{"version":"2.1.14","date":"2020-06-11"},{"version":"2.1.12","date":"2020-06-11"},{"version":"2.1.11","date":"2020-06-11"},{"version":"2.1.10","date":"2020-06-11"},{"version":"2.1.9","date":"2020-06-11"},{"version":"2.1.8","date":"2020-06-11"},{"version":"2.1.7","date":"2020-06-11"},{"version":"2.1.6","date":"2020-06-11"},{"version":"2.1.5","date":"2020-06-11"},{"version":"2.1.4","date":"2020-06-11"},{"version":"2.1.3","date":"2020-06-11"},{"version":"2.1.2","date":"2020-06-11"},{"version":"2.1.1","date":"2020-06-11"},{"version":"2.1.0","date":"2020-06-11"},{"version":"2.0.0","date":"2020-06-11"},{"version":"1.3.0","date":"2020-06-11"},{"version":"1.1.1","date":"2020-06-11"},{"version":"1.1.0","date":"2020-06-11"},{"version":"1.0.3","date":"2020-06-11"},{"version":"1.0.2","date":"2020-06-11"}],"crawled_at":"2026-10-25"},"edges":{"maintainers":[],"contributors":[],"explained_by":[],"alternative_to_this":[],"needed_by":[{"ref":"artifact:arc-mcp-xsuaa-auth","name":"@arc-mcp/xsuaa-auth","json":"/artifacts/arc-mcp-xsuaa-auth.json","requirement":"required","role":"dependency"},{"ref":"artifact:cap-js-cds-federation-synonyms","name":"cds-federation-synonyms","json":"/artifacts/cap-js-cds-federation-synonyms.json","requirement":"required"}],"available_via":[],"parts":[],"add_ons":[],"answered_through_parts":[]}}