Framework integrations

Each guide below installs Bunkhouse the way that framework expects: the identity endpoint in its routing, the user from its authentication, the loader in its root layout, its CSRF token in getAuthHeaders and the Bunkhouse sources in its Content Security Policy. Every code block on those pages is imported from a runnable example app, and each app passes the same end-to-end checks against the real Bunkhouse API and embed.

Read Installation first for the session modes. The guides add framework specifics; they do not change what the installation requires.

JavaScript and TypeScript

• Angular with an Express backend
• Astro (server output)
• Express
• Fastify
• Hono
• NestJS
• Next.js (App Router)
• Nuxt
• React with an Express backend
• SvelteKit
• Vue with an Express backend

React is a UI library rather than a full framework. The React, Vue and Angular examples are single-page apps that run in the browser, so their guides pair the app with the Express backend that signs identity tokens: a browser must never hold a signing secret or mint key.

Python

• Django
• FastAPI
• Flask

Java

• Micronaut
• Quarkus
• Spring Boot

C# and .NET

• ASP.NET Core
• Blazor (Blazor Web App, Interactive Server)

PHP

• CodeIgniter
• Laravel
• Symfony

Ruby

• Ruby on Rails
• Sinatra

Go

• chi
• Echo
• Fiber
• Gin

Rust

• Actix Web
• Axum

How the list was chosen

The list covers widely used web frameworks, based on the 2026 Stack Overflow Developer Survey and ecosystem surveys such as JetBrains’ Go, Java and PHP reports. It is coverage of common choices in each language, not a ranking. Runtimes, content management systems and Windows-only ASP.NET are not listed as frameworks. If your framework is missing, the Installation guide’s requirements apply to any server that can authenticate a user and sign an HS256 token.

Running the examples

The example apps live in apps/docs/integrations/<framework>/ of the Bunkhouse repository. Their dependencies install and build only inside Docker. With Docker, Node.js 24, Playwright’s Chromium and a local Supabase stack, one command builds an example, starts it against a fresh local site and drives the real assistant pane:

node tests/framework-integrations/run.ts nextjs   # one framework
node tests/framework-integrations/run.ts all      # all 30

Each run checks identity-token, server-mint and anonymous sessions, the endpoints’ method, origin, Fetch Metadata and sign-in checks, impersonation attempts, session resets on sign-out and account switches, discovery of the app’s startup request, a CSRF-protected write through getAuthHeaders, the page’s Content Security Policy, that no secret reaches the page or the model, and error forwarding from the mint endpoint. Model responses are replayed fixtures; the API, embed and database are real. The examples run on loopback HTTP, so production TLS and Secure cookies are outside what these runs prove.