Browse Documentation
Foundation
Platform
Capabilities
Product
Core Platform
Core Platform
Developers
Operations
Business
Billing and Plans
Billing and Plans
Express belongs to the same runtime contract, but it should still feel native to its own request boundary.
Middleware enforcement for existing Node API servers. Choose the server package when handlers, hooks, or fetch semantics are the real request boundary. The page should help you choose this surface deliberately, compare it against its lane neighbors, and keep operator proof in reach while you wire the integration.
lane family
9
Server runtime
package line
1
@cosantoir/express
contract vars
3
Shared across wrappers and native SDKs
operator lanes
2
Plus 2 native package families
Surface fit
Choose this surface when the boundary is real, not convenient.
A better docs system tells you why this lane exists, what makes it distinct, and how it hands off to the rest of the platform.
Use this when
Choose the server package when handlers, hooks, or fetch semantics are the real request boundary.
Package line
@cosantoir/express
The install and contract line should stay recognizable even when the request lifecycle changes.
First proof
Protect one real route, loader, or handler first, then read the resulting headers and decision state before broadening the rollout.
Install line
Express package install
01pnpm add @cosantoir/express @cosantoir/nodeShared contract
Runtime identity
01COSANTOIR_GATEWAY_URL=http://localhost:400002COSANTOIR_API_KEY=dp_live_example03COSANTOIR_SITE_ID=site_prod_webContract discipline
The framework changes. The contract should not.
This is the point where the left rail, page body, and right rail need to agree: the package can change, but the gateway origin, runtime key, site id, and proof loop stay the same.
01
COSANTOIR_GATEWAY_URL
Keep this value aligned across application middleware, direct SDK probes, and operator tooling so the same request path stays explainable.
02
COSANTOIR_API_KEY
Keep this value aligned across application middleware, direct SDK probes, and operator tooling so the same request path stays explainable.
03
COSANTOIR_SITE_ID
Keep this value aligned across application middleware, direct SDK probes, and operator tooling so the same request path stays explainable.
Lane neighbors
Neighbor surfaces
A mature docs system makes adjacent choices visible. If this page is not the right boundary, the best alternative should already be in front of you.
Server runtime
Hono
Fetch-native protection for edge and lightweight runtimes.
Server runtime
Fastify
Fast pre-handler hooks for high-throughput APIs.
Server runtime
Koa
Async middleware protection inside Koa request chains.
Server runtime
Elysia
Plugin entry point for Bun-native Elysia services.
Server runtime
AdonisJS
HTTP middleware integration for AdonisJS applications.
Server runtime
NestJS
Guard and interceptor-oriented protection inside Nest applications.
Handoff
Node.js
Direct evaluator client for custom servers, bespoke middleware order, and exact transport control.
Handoff
CLI
Terminal lane for login, request probes, and telemetry-backed operator workflows.
Handoff
MCP
Model-facing tool server for safe policy and evaluator access.
Launch route
Quickstart
Wire a first protected request and stop only when the receipt is explainable.
Control map
Architecture
Trace how the wrapper, gateway, evaluator, and dashboard stay on the same contract line.
Operator lane
CLI
Bootstrap credentials, run probes, and inspect runtime decisions without leaving the terminal.
Agent lane
MCP
Expose bounded runtime tools to model workflows without widening system reach.
Detailed guide
Express page guide
The framework-specific instructions live below, but they now sit inside a stronger system: lane fit above, contract line beside, neighbors nearby.
# Express Integration
Use the Express wrapper with the core Node client to inject runtime security into existing pipelines.
## Installation
``bash
npm install @cosantoir/express @cosantoir/node
`
## Usage
`ts
import express from 'express';
import { createCosantoir } from '@cosantoir/node';
import { createDeveloperProtectionExpressMiddleware, readExpressRequestIp } from '@cosantoir/express';
const app = express();
const client = createCosantoir({
baseUrl: process.env.COSANTOIR_GATEWAY_URL!,
apiKey: process.env.COSANTOIR_API_KEY!,
siteId: process.env.COSANTOIR_SITE_ID!
});
app.use('/protected', createDeveloperProtectionExpressMiddleware({ client }));
app.get('/protected', (req, res) => {
const ip = readExpressRequestIp(req) ?? req.ip;
res.send(This route is secure for ${ip}.);
});
app.listen(3000);
``