File size: 107,344 Bytes
c212805 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274 275 276 277 278 279 280 281 282 283 284 285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300 301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324 325 326 327 328 329 330 331 332 333 334 335 336 337 338 339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394 395 396 397 398 399 400 401 402 403 404 405 406 407 408 409 410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452 453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470 471 472 473 474 475 476 477 478 479 480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498 499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529 530 531 532 533 534 535 536 537 538 539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694 695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717 718 719 720 721 722 723 724 725 726 727 728 729 730 731 732 733 734 735 736 737 738 739 740 741 742 743 744 745 746 747 748 749 750 751 752 753 754 755 756 757 758 759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789 790 791 792 793 794 795 796 797 798 799 800 801 802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818 819 820 821 822 823 824 825 826 827 828 829 830 831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882 883 884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902 903 904 905 906 907 908 909 910 911 912 913 914 915 916 917 918 919 920 921 922 923 924 925 926 927 928 929 930 931 932 933 934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951 952 953 954 955 956 957 958 959 960 961 962 963 964 965 966 967 968 969 970 971 972 973 974 975 976 977 978 979 980 981 982 983 984 985 986 987 988 989 990 991 992 993 994 995 996 997 998 999 1000 1001 1002 1003 1004 1005 1006 1007 1008 1009 1010 1011 1012 1013 1014 1015 1016 1017 1018 1019 1020 1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033 1034 1035 1036 1037 1038 1039 1040 1041 1042 1043 1044 1045 1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073 1074 1075 1076 1077 1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151 1152 1153 1154 1155 1156 1157 1158 1159 1160 1161 1162 1163 1164 1165 1166 1167 1168 1169 1170 1171 1172 1173 1174 1175 1176 1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221 1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234 1235 1236 1237 1238 1239 1240 1241 1242 1243 1244 1245 1246 1247 1248 1249 1250 1251 1252 1253 1254 1255 1256 1257 1258 1259 1260 1261 1262 1263 1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274 1275 1276 1277 1278 1279 1280 1281 1282 1283 1284 1285 1286 1287 1288 1289 1290 1291 1292 1293 1294 1295 1296 1297 1298 1299 1300 1301 1302 1303 1304 1305 1306 1307 1308 1309 1310 1311 1312 1313 1314 1315 1316 1317 1318 1319 1320 1321 1322 1323 1324 1325 1326 1327 1328 1329 1330 1331 1332 1333 1334 1335 1336 1337 1338 1339 1340 1341 1342 1343 1344 1345 1346 1347 1348 1349 1350 1351 1352 1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364 1365 1366 1367 1368 1369 1370 1371 1372 1373 1374 1375 1376 1377 1378 1379 1380 1381 1382 1383 1384 1385 1386 1387 1388 1389 1390 1391 1392 1393 1394 1395 1396 1397 1398 1399 1400 1401 1402 1403 1404 1405 1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417 1418 1419 1420 1421 1422 1423 1424 1425 1426 1427 1428 1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458 1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496 1497 1498 1499 1500 1501 1502 1503 1504 1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541 1542 1543 1544 1545 1546 1547 1548 1549 1550 1551 1552 1553 1554 1555 1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585 1586 1587 1588 1589 1590 1591 1592 1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609 1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622 1623 1624 1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642 1643 1644 1645 1646 1647 1648 1649 1650 1651 1652 1653 1654 1655 1656 1657 1658 1659 1660 1661 1662 1663 1664 1665 1666 1667 1668 1669 1670 1671 1672 1673 1674 1675 1676 1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689 1690 1691 1692 1693 1694 1695 1696 1697 1698 1699 1700 1701 1702 1703 1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717 1718 1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729 1730 1731 1732 1733 1734 1735 1736 1737 1738 1739 1740 1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769 1770 1771 1772 1773 1774 1775 1776 1777 1778 1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791 1792 1793 1794 1795 1796 1797 1798 1799 1800 1801 1802 1803 1804 1805 1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840 1841 1842 1843 1844 1845 1846 1847 1848 1849 1850 1851 1852 1853 1854 1855 1856 1857 1858 1859 1860 1861 1862 1863 1864 1865 1866 1867 1868 1869 1870 1871 1872 1873 1874 1875 1876 1877 1878 1879 1880 1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906 1907 1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923 1924 1925 1926 1927 1928 1929 1930 1931 1932 1933 1934 1935 1936 1937 1938 1939 1940 1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974 1975 1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038 2039 2040 2041 2042 2043 2044 2045 2046 2047 2048 2049 2050 2051 2052 2053 2054 2055 2056 2057 2058 2059 2060 2061 2062 2063 2064 2065 2066 2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080 2081 2082 2083 2084 2085 2086 2087 2088 2089 2090 2091 2092 2093 2094 2095 2096 2097 2098 2099 2100 2101 2102 2103 2104 2105 2106 2107 2108 2109 2110 2111 2112 2113 2114 2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128 2129 2130 2131 2132 2133 2134 2135 2136 2137 2138 2139 2140 2141 2142 2143 2144 2145 2146 2147 2148 2149 2150 2151 2152 2153 2154 2155 2156 2157 2158 2159 2160 2161 2162 2163 2164 2165 2166 2167 2168 2169 2170 2171 2172 2173 2174 2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189 2190 2191 2192 2193 2194 2195 2196 2197 2198 2199 2200 2201 2202 2203 2204 2205 2206 2207 2208 2209 2210 2211 2212 2213 2214 2215 2216 2217 2218 2219 2220 2221 2222 2223 2224 2225 2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237 2238 2239 2240 2241 2242 2243 2244 2245 2246 2247 2248 2249 2250 2251 2252 2253 2254 2255 2256 2257 2258 2259 2260 2261 2262 2263 2264 2265 2266 2267 2268 2269 2270 2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281 2282 2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296 2297 2298 2299 2300 2301 2302 2303 2304 2305 2306 2307 2308 2309 2310 2311 2312 2313 2314 2315 2316 2317 2318 2319 2320 2321 2322 2323 2324 2325 2326 2327 2328 2329 2330 2331 2332 2333 2334 2335 2336 2337 2338 2339 2340 2341 2342 2343 2344 2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363 2364 2365 2366 2367 2368 2369 2370 2371 2372 2373 2374 2375 2376 2377 2378 2379 2380 2381 2382 2383 2384 2385 2386 2387 2388 2389 2390 2391 2392 2393 2394 2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407 2408 2409 2410 2411 2412 2413 2414 2415 2416 2417 2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444 2445 2446 2447 2448 2449 2450 2451 2452 2453 2454 2455 2456 2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474 2475 2476 2477 2478 2479 2480 2481 2482 2483 2484 2485 2486 2487 2488 2489 2490 2491 2492 2493 2494 2495 2496 2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515 2516 2517 2518 2519 2520 2521 2522 2523 2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534 2535 2536 2537 2538 2539 2540 2541 2542 2543 2544 2545 2546 2547 2548 2549 2550 2551 2552 2553 2554 2555 2556 2557 2558 2559 2560 2561 2562 2563 2564 2565 2566 2567 2568 2569 2570 2571 2572 2573 2574 2575 2576 2577 2578 2579 2580 2581 2582 2583 2584 2585 | import GoTrueAdminApi from './GoTrueAdminApi';
import { AuthError } from './lib/errors';
import { Fetch } from './lib/fetch';
import { Deferred } from './lib/helpers';
import type { AuthChangeEvent, AuthFlowType, AuthOtpResponse, AuthResponse, AuthTokenResponse, AuthTokenResponsePassword, CallRefreshTokenResult, GoTrueClientOptions, GoTrueMFAApi, InitializeResult, JWK, JwtHeader, JwtPayload, LockFunc, OAuthResponse, AuthOAuthServerApi, ResendParams, Session, SignInAnonymouslyCredentials, SignInWithIdTokenCredentials, SignInWithOAuthCredentials, SignInWithPasswordCredentials, SignInWithPasswordlessCredentials, SignInWithSSO, SignOut, SignUpWithPasswordCredentials, SSOResponse, Subscription, SupportedStorage, User, UserAttributes, UserIdentity, UserResponse, VerifyOtpParams, Web3Credentials, AuthPasskeyApi, ExperimentalFeatureFlags, SignInWithPasskeyCredentials, RegisterPasskeyCredentials, AuthPasskeyRegistrationVerifyResponse, AuthPasskeyAuthenticationVerifyResponse } from './lib/types';
export default class GoTrueClient {
private static nextInstanceID;
private instanceID;
/**
* Namespace for the GoTrue admin methods.
* These methods should only be used in a trusted server-side environment.
*/
admin: GoTrueAdminApi;
/**
* Namespace for the MFA methods.
*/
mfa: GoTrueMFAApi;
/**
* Namespace for the OAuth 2.1 authorization server methods.
* Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
* Used to implement the authorization code flow on the consent page.
*/
oauth: AuthOAuthServerApi;
/**
* Namespace for passkey methods.
* Includes lower-level two-step registration/authentication and passkey management.
*
* Requires `auth.experimental.passkey: true`; otherwise all methods throw.
*/
passkey: AuthPasskeyApi;
/**
* The storage key used to identify the values saved in localStorage
*/
protected storageKey: string;
protected flowType: AuthFlowType;
/**
* The JWKS used for verifying asymmetric JWTs
*/
protected get jwks(): {
keys: JWK[];
};
protected set jwks(value: {
keys: JWK[];
});
protected get jwks_cached_at(): number;
protected set jwks_cached_at(value: number);
protected autoRefreshToken: boolean;
protected persistSession: boolean;
protected storage: SupportedStorage;
/**
* @experimental
*/
protected userStorage: SupportedStorage | null;
protected memoryStorage: {
[key: string]: string;
} | null;
protected stateChangeEmitters: Map<string | symbol, Subscription>;
protected autoRefreshTicker: ReturnType<typeof setInterval> | null;
protected autoRefreshTickTimeout: ReturnType<typeof setTimeout> | null;
protected visibilityChangedCallback: (() => Promise<any>) | null;
protected refreshingDeferred: Deferred<CallRefreshTokenResult> | null;
/**
* Cache of the most recent refresh failure, keyed by the refresh token
* that failed. Serial callers passing the *same* token within
* `REFRESH_FAILURE_COOLDOWN_MS` (including subsequent auto-refresh ticks)
* receive this cached result instead of firing another `/token` request.
* Callers passing a *different* token (token rotation pickup, explicit
* `setSession`/`refreshSession({ refresh_token })`, multi-account switch)
* bypass the cache and attempt a fresh refresh as they should.
* Cleared on any successful refresh (locally or via BroadcastChannel from
* another tab) and on `_removeSession`.
*
* Pairs with `refreshingDeferred`: concurrent callers share the in-flight
* promise, serial callers within the cooldown share the failure result.
*/
protected lastRefreshFailure: {
refreshToken: string;
result: CallRefreshTokenResult;
expiresAt: number;
} | null;
/**
* Monotonic counter incremented at the top of `_removeSession`, before any
* `await`. The commit guard inside `_callRefreshToken` captures this value
* before `_saveSession` and re-checks it after, so a `signOut` that
* interleaves inside `_saveSession`'s storage-write awaits is still caught
* (the post-fetch storage snapshot alone misses that window).
*/
protected _sessionRemovalEpoch: number;
/**
* Keeps track of the async client initialization.
* When null or not yet resolved the auth state is `unknown`
* Once resolved the auth state is known and it's safe to call any further client methods.
* Keep extra care to never reject or throw uncaught errors
*/
protected initializePromise: Promise<InitializeResult> | null;
/**
* Non-null only while `initialize()` is running. While open,
* `_notifyAllSubscribers` enqueues init-chain notifications (those fired with
* `broadcast = true`, i.e. from `_recoverAndRefresh`) into this array instead
* of firing directly, so that `initializePromise` is guaranteed to be
* resolved before any subscriber callback runs. Callbacks that call
* `getSession()` / `getUser()` etc. would otherwise deadlock because those
* methods await `initializePromise`. Notifications from the incoming
* BroadcastChannel handler (`broadcast = false`) are not enqueued — they fire
* immediately. Flushed (in order) by `initialize()` after `initializePromise`
* settles.
*/
private _pendingInitNotifications;
protected detectSessionInUrl: boolean | ((url: URL, params: {
[parameter: string]: string;
}) => boolean);
protected url: string;
protected headers: {
[key: string]: string;
};
protected hasCustomAuthorizationHeader: boolean;
protected suppressGetSessionWarning: boolean;
protected fetch: Fetch;
/**
* Custom lock function passed via `settings.lock`. When non-null, every auth
* operation runs inside `_acquireLock`. When null (the default), the client
* uses its lockless coordination (refresh single-flight + commit guard).
* TODO(v3): remove along with the legacy lock path.
*/
protected lock: LockFunc | null;
protected lockAcquired: boolean;
protected pendingInLock: Promise<any>[];
protected throwOnError: boolean;
/**
* Only consulted when a custom `lock` is supplied. TODO(v3): remove.
*/
protected lockAcquireTimeout: number;
/**
* Opt-in flags for experimental features. Defaults to an empty object.
* See `GoTrueClientOptions.experimental`.
*/
protected experimental: ExperimentalFeatureFlags;
/**
* Used to broadcast state change events to other tabs listening.
*/
protected broadcastChannel: BroadcastChannel | null;
protected logDebugMessages: boolean;
protected logger: (message: string, ...args: any[]) => void;
/**
* Create a new client for use in the browser.
*
* @example Using supabase-js (recommended)
* ```ts
* import { createClient } from '@supabase/supabase-js'
*
* const supabase = createClient('https://xyzcompany.supabase.co', 'your-publishable-key')
* const { data, error } = await supabase.auth.getUser()
* ```
*
* @example Standalone import for bundle-sensitive environments
* ```ts
* import { GoTrueClient } from '@supabase/auth-js'
*
* const auth = new GoTrueClient({
* url: 'https://xyzcompany.supabase.co/auth/v1',
* headers: { apikey: 'your-publishable-key' },
* storageKey: 'supabase-auth',
* })
* ```
*/
constructor(options: GoTrueClientOptions);
/**
* Returns whether error throwing mode is enabled for this client.
*/
isThrowOnErrorEnabled(): boolean;
/**
* Centralizes return handling with optional error throwing. When `throwOnError` is enabled
* and the provided result contains a non-nullish error, the error is thrown instead of
* being returned. This ensures consistent behavior across all public API methods.
*/
private _returnResult;
private _logPrefix;
private _debug;
/**
* Initialize the auth client by loading the session from storage or
* detecting it from the URL after an OAuth, magic-link, or password-recovery
* redirect.
*
* **Most callers do not need to invoke this directly.** The client calls it
* automatically during construction, and to react to sign-in events (including
* post-redirect events) you should subscribe to `onAuthStateChange` rather
* than awaiting `initialize()`.
*
* You only need to call it manually when you have opted out of the automatic
* call by passing `skipAutoInitialize: true` — for example, in an SSR context
* where you need to control initialization timing. In that case, awaiting
* `initialize()` returns the resolved session result (or any error encountered
* while detecting it from the URL).
*
* @category Auth
*/
initialize(): Promise<InitializeResult>;
/**
* IMPORTANT:
* 1. Never throw in this method, as it is called from the constructor
* 2. Never return a session from this method as it would be cached over
* the whole lifetime of the client
*/
private _initialize;
/**
* Creates a new anonymous user.
*
* @returns A session where the is_anonymous claim in the access token JWT set to true
*
* @category Auth
*
* @remarks
* - Returns an anonymous user
* - It is recommended to set up captcha for anonymous sign-ins to prevent abuse. You can pass in the captcha token in the `options` param.
*
* @example Create an anonymous user
* ```js
* const { data, error } = await supabase.auth.signInAnonymously({
* options: {
* captchaToken
* }
* });
* ```
*
* @exampleResponse Create an anonymous user
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "",
* "phone": "",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {},
* "user_metadata": {},
* "identities": [],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": true
* },
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "token_type": "bearer",
* "expires_in": 3600,
* "expires_at": 1700000000,
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "",
* "phone": "",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {},
* "user_metadata": {},
* "identities": [],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": true
* }
* }
* },
* "error": null
* }
* ```
*
* @example Create an anonymous user with custom user metadata
* ```js
* const { data, error } = await supabase.auth.signInAnonymously({
* options: {
* data
* }
* })
* ```
*/
signInAnonymously(credentials?: SignInAnonymouslyCredentials): Promise<AuthResponse>;
/**
* Creates a new user.
*
* Be aware that if a user account exists in the system you may get back an
* error message that attempts to hide this information from the user.
* This method has support for PKCE via email signups. The PKCE flow cannot be used when autoconfirm is enabled.
*
* @returns A logged-in session if the server has "autoconfirm" ON
* @returns A user if the server has "autoconfirm" OFF
*
* @category Auth
*
* @remarks
* - By default, the user needs to verify their email address before logging in. To turn this off, disable **Confirm email** in [your project](/dashboard/project/_/auth/providers).
* - **Confirm email** determines if users need to confirm their email address after signing up.
* - If **Confirm email** is enabled, a `user` is returned but `session` is null.
* - If **Confirm email** is disabled, both a `user` and a `session` are returned.
* - When the user confirms their email address, they are redirected to the [`SITE_URL`](/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls) by default. You can modify your `SITE_URL` or add additional redirect URLs in [your project](/dashboard/project/_/auth/url-configuration).
* - If signUp() is called for an existing confirmed user:
* - When both **Confirm email** and **Confirm phone** (even when phone provider is disabled) are enabled in [your project](/dashboard/project/_/auth/providers), an obfuscated/fake user object is returned.
* - When either **Confirm email** or **Confirm phone** (even when phone provider is disabled) is disabled, the error message, `User already registered` is returned.
* - To fetch the currently logged-in user, refer to [`getUser()`](/docs/reference/javascript/auth-getuser).
*
* @example Sign up with an email and password
* ```js
* const { data, error } = await supabase.auth.signUp({
* email: 'example@email.com',
* password: 'example-password',
* })
* ```
*
* @exampleResponse Sign up with an email and password
* ```json
* // Some fields may be null if "confirm email" is enabled.
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {},
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z"
* },
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "token_type": "bearer",
* "expires_in": 3600,
* "expires_at": 1700000000,
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {},
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z"
* }
* }
* },
* "error": null
* }
* ```
*
* @example Sign up with a phone number and password (SMS)
* ```js
* const { data, error } = await supabase.auth.signUp({
* phone: '123456789',
* password: 'example-password',
* options: {
* channel: 'sms'
* }
* })
* ```
*
* @exampleDescription Sign up with a phone number and password (whatsapp)
* The user will be sent a WhatsApp message which contains a OTP. By default, a given user can only request a OTP once every 60 seconds. Note that a user will need to have a valid WhatsApp account that is linked to Twilio in order to use this feature.
*
* @example Sign up with a phone number and password (whatsapp)
* ```js
* const { data, error } = await supabase.auth.signUp({
* phone: '123456789',
* password: 'example-password',
* options: {
* channel: 'whatsapp'
* }
* })
* ```
*
* @example Sign up with additional user metadata
* ```js
* const { data, error } = await supabase.auth.signUp(
* {
* email: 'example@email.com',
* password: 'example-password',
* options: {
* data: {
* first_name: 'John',
* age: 27,
* }
* }
* }
* )
* ```
*
* @exampleDescription Sign up with a redirect URL
* - See [redirect URLs and wildcards](/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls) to add additional redirect URLs to your project.
*
* @example Sign up with a redirect URL
* ```js
* const { data, error } = await supabase.auth.signUp(
* {
* email: 'example@email.com',
* password: 'example-password',
* options: {
* emailRedirectTo: 'https://example.com/welcome'
* }
* }
* )
* ```
*/
signUp(credentials: SignUpWithPasswordCredentials): Promise<AuthResponse>;
/**
* Log in an existing user with an email and password or phone and password.
*
* Be aware that you may get back an error message that will not distinguish
* between the cases where the account does not exist or that the
* email/phone and password combination is wrong or that the account can only
* be accessed via social login.
*
* @category Auth
*
* @remarks
* - Requires either an email and password or a phone number and password.
*
* @example Sign in with email and password
* ```js
* const { data, error } = await supabase.auth.signInWithPassword({
* email: 'example@email.com',
* password: 'example-password',
* })
* ```
*
* @exampleResponse Sign in with email and password
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {},
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z"
* },
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "token_type": "bearer",
* "expires_in": 3600,
* "expires_at": 1700000000,
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {},
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z"
* }
* }
* },
* "error": null
* }
* ```
*
* @example Sign in with phone and password
* ```js
* const { data, error } = await supabase.auth.signInWithPassword({
* phone: '+13334445555',
* password: 'some-password',
* })
* ```
*
* @exampleDescription Handling errors
* Log the full `error` object so fields like `code`, `status`, and `name` aren't hidden. The `error.code` (e.g. `'invalid_credentials'`, `'email_not_confirmed'`) is often more useful for branching than `error.message`, and the full object surfaces both.
*
* @example Handling errors
* ```js
* const { data, error } = await supabase.auth.signInWithPassword({
* email: 'example@email.com',
* password: 'example-password',
* })
* if (error) {
* console.error(error)
* return
* }
* ```
*/
signInWithPassword(credentials: SignInWithPasswordCredentials): Promise<AuthTokenResponsePassword>;
/**
* Log in an existing user via a third-party provider.
* This method supports the PKCE flow.
*
* @category Auth
*
* @remarks
* - This method is used for signing in using [Social Login (OAuth) providers](/docs/guides/auth#configure-third-party-providers).
* - It works by redirecting your application to the provider's authorization screen, before bringing back the user to your app.
*
* @example Sign in using a third-party provider
* ```js
* const { data, error } = await supabase.auth.signInWithOAuth({
* provider: 'github'
* })
* ```
*
* @exampleResponse Sign in using a third-party provider
* ```json
* {
* data: {
* provider: 'github',
* url: <PROVIDER_URL_TO_REDIRECT_TO>
* },
* error: null
* }
* ```
*
* @exampleDescription Sign in using a third-party provider with redirect
* - When the OAuth provider successfully authenticates the user, they are redirected to the URL specified in the `redirectTo` parameter. This parameter defaults to the [`SITE_URL`](/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls). It does not redirect the user immediately after invoking this method.
* - See [redirect URLs and wildcards](/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls) to add additional redirect URLs to your project.
*
* @example Sign in using a third-party provider with redirect
* ```js
* const { data, error } = await supabase.auth.signInWithOAuth({
* provider: 'github',
* options: {
* redirectTo: 'https://example.com/welcome'
* }
* })
* ```
*
* @exampleDescription Sign in with scopes and access provider tokens
* If you need additional access from an OAuth provider, in order to access provider specific APIs in the name of the user, you can do this by passing in the scopes the user should authorize for your application. Note that the `scopes` option takes in **a space-separated list** of scopes.
*
* Because OAuth sign-in often includes redirects, you should register an `onAuthStateChange` callback immediately after you create the Supabase client. This callback will listen for the presence of `provider_token` and `provider_refresh_token` properties on the `session` object and store them in local storage. The client library will emit these values **only once** immediately after the user signs in. You can then access them by looking them up in local storage, or send them to your backend servers for further processing.
*
* Finally, make sure you remove them from local storage on the `SIGNED_OUT` event. If the OAuth provider supports token revocation, make sure you call those APIs either from the frontend or schedule them to be called on the backend.
*
* @example Sign in with scopes and access provider tokens
* ```js
* // Register this immediately after calling createClient!
* // Because signInWithOAuth causes a redirect, you need to fetch the
* // provider tokens from the callback.
* supabase.auth.onAuthStateChange((event, session) => {
* if (session && session.provider_token) {
* window.localStorage.setItem('oauth_provider_token', session.provider_token)
* }
*
* if (session && session.provider_refresh_token) {
* window.localStorage.setItem('oauth_provider_refresh_token', session.provider_refresh_token)
* }
*
* if (event === 'SIGNED_OUT') {
* window.localStorage.removeItem('oauth_provider_token')
* window.localStorage.removeItem('oauth_provider_refresh_token')
* }
* })
*
* // Call this on your Sign in with GitHub button to initiate OAuth
* // with GitHub with the requested elevated scopes.
* await supabase.auth.signInWithOAuth({
* provider: 'github',
* options: {
* scopes: 'repo gist notifications'
* }
* })
* ```
*/
signInWithOAuth(credentials: SignInWithOAuthCredentials): Promise<OAuthResponse>;
/**
* Log in an existing user by exchanging an Auth Code issued during the PKCE flow.
*
* @category Auth
*
* @remarks
* - Used when `flowType` is set to `pkce` in client options.
*
* @example Exchange Auth Code
* ```js
* supabase.auth.exchangeCodeForSession('34e770dd-9ff9-416c-87fa-43b31d7ef225')
* ```
*
* @exampleResponse Exchange Auth Code
* ```json
* {
* "data": {
* session: {
* access_token: '<ACCESS_TOKEN>',
* token_type: 'bearer',
* expires_in: 3600,
* expires_at: 1700000000,
* refresh_token: '<REFRESH_TOKEN>',
* user: {
* id: '11111111-1111-1111-1111-111111111111',
* aud: 'authenticated',
* role: 'authenticated',
* email: 'example@email.com'
* email_confirmed_at: '2024-01-01T00:00:00Z',
* phone: '',
* confirmation_sent_at: '2024-01-01T00:00:00Z',
* confirmed_at: '2024-01-01T00:00:00Z',
* last_sign_in_at: '2024-01-01T00:00:00Z',
* app_metadata: {
* "provider": "email",
* "providers": [
* "email",
* "<OTHER_PROVIDER>"
* ]
* },
* user_metadata: {
* email: 'email@email.com',
* email_verified: true,
* full_name: 'User Name',
* iss: '<ISS>',
* name: 'User Name',
* phone_verified: false,
* provider_id: '<PROVIDER_ID>',
* sub: '<SUB>'
* },
* identities: [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "email@example.com"
* },
* {
* "identity_id": "33333333-3333-3333-3333-333333333333",
* "id": "<ID>",
* "user_id": "<USER_ID>",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": true,
* "full_name": "User Name",
* "iss": "<ISS>",
* "name": "User Name",
* "phone_verified": false,
* "provider_id": "<PROVIDER_ID>",
* "sub": "<SUB>"
* },
* "provider": "<PROVIDER>",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* created_at: '2024-01-01T00:00:00Z',
* updated_at: '2024-01-01T00:00:00Z',
* is_anonymous: false
* },
* provider_token: '<PROVIDER_TOKEN>',
* provider_refresh_token: '<PROVIDER_REFRESH_TOKEN>'
* },
* user: {
* id: '11111111-1111-1111-1111-111111111111',
* aud: 'authenticated',
* role: 'authenticated',
* email: 'example@email.com',
* email_confirmed_at: '2024-01-01T00:00:00Z',
* phone: '',
* confirmation_sent_at: '2024-01-01T00:00:00Z',
* confirmed_at: '2024-01-01T00:00:00Z',
* last_sign_in_at: '2024-01-01T00:00:00Z',
* app_metadata: {
* provider: 'email',
* providers: [
* "email",
* "<OTHER_PROVIDER>"
* ]
* },
* user_metadata: {
* email: 'email@email.com',
* email_verified: true,
* full_name: 'User Name',
* iss: '<ISS>',
* name: 'User Name',
* phone_verified: false,
* provider_id: '<PROVIDER_ID>',
* sub: '<SUB>'
* },
* identities: [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "email@example.com"
* },
* {
* "identity_id": "33333333-3333-3333-3333-333333333333",
* "id": "<ID>",
* "user_id": "<USER_ID>",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": true,
* "full_name": "User Name",
* "iss": "<ISS>",
* "name": "User Name",
* "phone_verified": false,
* "provider_id": "<PROVIDER_ID>",
* "sub": "<SUB>"
* },
* "provider": "<PROVIDER>",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* created_at: '2024-01-01T00:00:00Z',
* updated_at: '2024-01-01T00:00:00Z',
* is_anonymous: false
* },
* redirectType: null
* },
* "error": null
* }
* ```
*/
exchangeCodeForSession(authCode: string): Promise<AuthTokenResponse>;
/**
* Signs in a user by verifying a message signed by the user's private key.
* Supports Ethereum (via Sign-In-With-Ethereum) & Solana (Sign-In-With-Solana) standards,
* both of which derive from the EIP-4361 standard
* With slight variation on Solana's side.
* @reference https://eips.ethereum.org/EIPS/eip-4361
*
* @category Auth
*
* @remarks
* - Uses a Web3 (Ethereum, Solana) wallet to sign a user in.
* - Read up on the [potential for abuse](/docs/guides/auth/auth-web3#potential-for-abuse) before using it.
*
* @example Sign in with Solana or Ethereum (Window API)
* ```js
* // uses window.ethereum for the wallet
* const { data, error } = await supabase.auth.signInWithWeb3({
* chain: 'ethereum',
* statement: 'I accept the Terms of Service at https://example.com/tos'
* })
*
* // uses window.solana for the wallet
* const { data, error } = await supabase.auth.signInWithWeb3({
* chain: 'solana',
* statement: 'I accept the Terms of Service at https://example.com/tos'
* })
* ```
*
* @example Sign in with Ethereum (Message and Signature)
* ```js
* const { data, error } = await supabase.auth.signInWithWeb3({
* chain: 'ethereum',
* message: '<sign in with ethereum message>',
* signature: '<hex of the ethereum signature over the message>',
* })
* ```
*
* @example Sign in with Solana (Brave)
* ```js
* const { data, error } = await supabase.auth.signInWithWeb3({
* chain: 'solana',
* statement: 'I accept the Terms of Service at https://example.com/tos',
* wallet: window.braveSolana
* })
* ```
*
* @example Sign in with Solana (Wallet Adapter)
* ```jsx
* function SignInButton() {
* const wallet = useWallet()
*
* return (
* <>
* {wallet.connected ? (
* <button
* onClick={() => {
* supabase.auth.signInWithWeb3({
* chain: 'solana',
* statement: 'I accept the Terms of Service at https://example.com/tos',
* wallet,
* })
* }}
* >
* Sign in with Solana
* </button>
* ) : (
* <WalletMultiButton />
* )}
* </>
* )
* }
*
* function App() {
* const endpoint = clusterApiUrl('devnet')
* const wallets = useMemo(() => [], [])
*
* return (
* <ConnectionProvider endpoint={endpoint}>
* <WalletProvider wallets={wallets}>
* <WalletModalProvider>
* <SignInButton />
* </WalletModalProvider>
* </WalletProvider>
* </ConnectionProvider>
* )
* }
* ```
*/
signInWithWeb3(credentials: Web3Credentials): Promise<{
data: {
session: Session;
user: User;
};
error: null;
} | {
data: {
session: null;
user: null;
};
error: AuthError;
}>;
private signInWithEthereum;
private signInWithSolana;
private _exchangeCodeForSession;
/**
* Allows signing in with an OIDC ID token. The authentication provider used
* should be enabled and configured.
*
* @category Auth
*
* @remarks
* - Use an ID token to sign in.
* - Especially useful when implementing sign in using native platform dialogs in mobile or desktop apps using Sign in with Apple or Sign in with Google on iOS and Android.
* - You can also use Google's [One Tap](https://developers.google.com/identity/gsi/web/guides/display-google-one-tap) and [Automatic sign-in](https://developers.google.com/identity/gsi/web/guides/automatic-sign-in-sign-out) via this API.
*
* @example Sign In using ID Token
* ```js
* const { data, error } = await supabase.auth.signInWithIdToken({
* provider: 'google',
* token: 'your-id-token'
* })
* ```
*
* @exampleResponse Sign In using ID Token
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* ...
* },
* "user_metadata": {
* ...
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "provider": "google",
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* },
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "token_type": "bearer",
* "expires_in": 3600,
* "expires_at": 1700000000,
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* ...
* },
* "user_metadata": {
* ...
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "provider": "google",
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* }
* }
* },
* "error": null
* }
* ```
*/
signInWithIdToken(credentials: SignInWithIdTokenCredentials): Promise<AuthTokenResponse>;
/**
* Log in a user using magiclink or a one-time password (OTP).
*
* If the `{{ .ConfirmationURL }}` variable is specified in the email template, a magiclink will be sent.
* If the `{{ .Token }}` variable is specified in the email template, an OTP will be sent.
* If you're using phone sign-ins, only an OTP will be sent. You won't be able to send a magiclink for phone sign-ins.
*
* Be aware that you may get back an error message that will not distinguish
* between the cases where the account does not exist or, that the account
* can only be accessed via social login.
*
* Do note that you will need to configure a Whatsapp sender on Twilio
* if you are using phone sign in with the 'whatsapp' channel. The whatsapp
* channel is not supported on other providers
* at this time.
* This method supports PKCE when an email is passed.
*
* @category Auth
*
* @remarks
* - Requires either an email or phone number.
* - This method is used for passwordless sign-ins where a OTP is sent to the user's email or phone number.
* - If the user doesn't exist, `signInWithOtp()` will signup the user instead. To restrict this behavior, you can set `shouldCreateUser` in `SignInWithPasswordlessCredentials.options` to `false`.
* - If you're using an email, you can configure whether you want the user to receive a magiclink or a OTP.
* - If you're using phone, you can configure whether you want the user to receive a OTP.
* - The magic link's destination URL is determined by the [`SITE_URL`](/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls).
* - See [redirect URLs and wildcards](/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls) to add additional redirect URLs to your project.
* - Magic links and OTPs share the same implementation. To send users a one-time code instead of a magic link, [modify the magic link email template](/dashboard/project/_/auth/templates) to include `{{ .Token }}` instead of `{{ .ConfirmationURL }}`.
* - See our [Twilio Phone Auth Guide](/docs/guides/auth/phone-login?showSMSProvider=Twilio) for details about configuring WhatsApp sign in.
*
* @exampleDescription Sign in with email
* The user will be sent an email which contains either a magiclink or a OTP or both. By default, a given user can only request a OTP once every 60 seconds.
*
* @example Sign in with email
* ```js
* const { data, error } = await supabase.auth.signInWithOtp({
* email: 'example@email.com',
* options: {
* emailRedirectTo: 'https://example.com/welcome'
* }
* })
* ```
*
* @exampleResponse Sign in with email
* ```json
* {
* "data": {
* "user": null,
* "session": null
* },
* "error": null
* }
* ```
*
* @exampleDescription Sign in with SMS OTP
* The user will be sent a SMS which contains a OTP. By default, a given user can only request a OTP once every 60 seconds.
*
* @example Sign in with SMS OTP
* ```js
* const { data, error } = await supabase.auth.signInWithOtp({
* phone: '+13334445555',
* })
* ```
*
* @exampleDescription Sign in with WhatsApp OTP
* The user will be sent a WhatsApp message which contains a OTP. By default, a given user can only request a OTP once every 60 seconds. Note that a user will need to have a valid WhatsApp account that is linked to Twilio in order to use this feature.
*
* @example Sign in with WhatsApp OTP
* ```js
* const { data, error } = await supabase.auth.signInWithOtp({
* phone: '+13334445555',
* options: {
* channel:'whatsapp',
* }
* })
* ```
*/
signInWithOtp(credentials: SignInWithPasswordlessCredentials): Promise<AuthOtpResponse>;
/**
* Log in a user given a User supplied OTP or TokenHash received through mobile or email.
*
* @category Auth
*
* @remarks
* - The `verifyOtp` method takes in different verification types.
* - If a phone number is used, the type can either be:
* 1. `sms` – Used when verifying a one-time password (OTP) sent via SMS during sign-up or sign-in.
* 2. `phone_change` – Used when verifying an OTP sent to a new phone number during a phone number update process.
* - If an email address is used, the type can be one of the following (note: `signup` and `magiclink` types are deprecated):
* 1. `email` – Used when verifying an OTP sent to the user's email during sign-up or sign-in.
* 2. `recovery` – Used when verifying an OTP sent for account recovery, typically after a password reset request.
* 3. `invite` – Used when verifying an OTP sent as part of an invitation to join a project or organization.
* 4. `email_change` – Used when verifying an OTP sent to a new email address during an email update process.
* - The verification type used should be determined based on the corresponding auth method called before `verifyOtp` to sign up / sign-in a user.
* - The `TokenHash` is contained in the [email templates](/docs/guides/auth/auth-email-templates) and can be used to sign in. You may wish to use the hash for the PKCE flow for Server Side Auth. Read [the Password-based Auth guide](/docs/guides/auth/passwords) for more details.
*
* @example Verify Signup One-Time Password (OTP)
* ```js
* const { data, error } = await supabase.auth.verifyOtp({ email, token, type: 'email'})
* ```
*
* @exampleResponse Verify Signup One-Time Password (OTP)
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "recovery_sent_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* },
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "token_type": "bearer",
* "expires_in": 3600,
* "expires_at": 1700000000,
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "recovery_sent_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* }
* }
* },
* "error": null
* }
* ```
*
* @example Verify SMS One-Time Password (OTP)
* ```js
* const { data, error } = await supabase.auth.verifyOtp({ phone, token, type: 'sms'})
* ```
*
* @example Verify Email Auth (Token Hash)
* ```js
* const { data, error } = await supabase.auth.verifyOtp({ token_hash: tokenHash, type: 'email'})
* ```
*/
verifyOtp(params: VerifyOtpParams): Promise<AuthResponse>;
/**
* Attempts a single-sign on using an enterprise Identity Provider. A
* successful SSO attempt will redirect the current page to the identity
* provider authorization page. The redirect URL is implementation and SSO
* protocol specific.
*
* You can use it by providing a SSO domain. Typically you can extract this
* domain by asking users for their email address. If this domain is
* registered on the Auth instance the redirect will use that organization's
* currently active SSO Identity Provider for the login.
*
* If you have built an organization-specific login page, you can use the
* organization's SSO Identity Provider UUID directly instead.
*
* @category Auth
*
* @remarks
* - Before you can call this method you need to [establish a connection](/docs/guides/auth/sso/auth-sso-saml#managing-saml-20-connections) to an identity provider. Use the [CLI commands](/docs/reference/cli/supabase-sso) to do this.
* - If you've associated an email domain to the identity provider, you can use the `domain` property to start a sign-in flow.
* - In case you need to use a different way to start the authentication flow with an identity provider, you can use the `providerId` property. For example:
* - Mapping specific user email addresses with an identity provider.
* - Using different hints to identity the identity provider to be used by the user, like a company-specific page, IP address or other tracking information.
*
* @example Sign in with email domain
* ```js
* // You can extract the user's email domain and use it to trigger the
* // authentication flow with the correct identity provider.
*
* const { data, error } = await supabase.auth.signInWithSSO({
* domain: 'company.com'
* })
*
* if (data?.url) {
* // redirect the user to the identity provider's authentication flow
* window.location.href = data.url
* }
* ```
*
* @example Sign in with provider UUID
* ```js
* // Useful when you need to map a user's sign in request according
* // to different rules that can't use email domains.
*
* const { data, error } = await supabase.auth.signInWithSSO({
* providerId: '21648a9d-8d5a-4555-a9d1-d6375dc14e92'
* })
*
* if (data?.url) {
* // redirect the user to the identity provider's authentication flow
* window.location.href = data.url
* }
* ```
*/
signInWithSSO(params: SignInWithSSO): Promise<SSOResponse>;
/**
* Sends a reauthentication OTP to the user's email or phone number.
* Requires the user to be signed-in.
*
* @category Auth
*
* @remarks
* - This method is used together with `updateUser()` when a user's password needs to be updated.
* - If you require your user to reauthenticate before updating their password, you need to enable the **Secure password change** option in your [project's email provider settings](/dashboard/project/_/auth/providers).
* - A user is only require to reauthenticate before updating their password if **Secure password change** is enabled and the user **hasn't recently signed in**. A user is deemed recently signed in if the session was created in the last 24 hours.
* - This method will send a nonce to the user's email. If the user doesn't have a confirmed email address, the method will send the nonce to the user's confirmed phone number instead.
* - After receiving the OTP, include it as the `nonce` in your `updateUser()` call to finalize the password change.
*
* @exampleDescription Send reauthentication nonce
* Sends a reauthentication nonce to the user's email or phone number.
*
* @example Send reauthentication nonce
* ```js
* const { error } = await supabase.auth.reauthenticate()
* ```
*/
reauthenticate(): Promise<AuthResponse>;
private _reauthenticate;
/**
* Resends an existing signup confirmation email, email change email, SMS OTP or phone change OTP.
*
* @category Auth
*
* @remarks
* - Resends a signup confirmation, email change or phone change email to the user.
* - Passwordless sign-ins can be resent by calling the `signInWithOtp()` method again.
* - Password recovery emails can be resent by calling the `resetPasswordForEmail()` method again.
* - This method will only resend an email or phone OTP to the user if there was an initial signup, email change or phone change request being made(note: For existing users signing in with OTP, you should use `signInWithOtp()` again to resend the OTP).
* - You can specify a redirect url when you resend an email link using the `emailRedirectTo` option.
*
* @exampleDescription Resend an email signup confirmation
* Resends the email signup confirmation to the user
*
* @example Resend an email signup confirmation
* ```js
* const { error } = await supabase.auth.resend({
* type: 'signup',
* email: 'email@example.com',
* options: {
* emailRedirectTo: 'https://example.com/welcome'
* }
* })
* ```
*
* @exampleDescription Resend a phone signup confirmation
* Resends the phone signup confirmation email to the user
*
* @example Resend a phone signup confirmation
* ```js
* const { error } = await supabase.auth.resend({
* type: 'sms',
* phone: '1234567890'
* })
* ```
*
* @exampleDescription Resend email change email
* Resends the email change email to the user
*
* @example Resend email change email
* ```js
* const { error } = await supabase.auth.resend({
* type: 'email_change',
* email: 'email@example.com'
* })
* ```
*
* @exampleDescription Resend phone change OTP
* Resends the phone change OTP to the user
*
* @example Resend phone change OTP
* ```js
* const { error } = await supabase.auth.resend({
* type: 'phone_change',
* phone: '1234567890'
* })
* ```
*/
resend(credentials: ResendParams): Promise<AuthOtpResponse>;
/**
* Returns the session, refreshing it if necessary.
*
* The session returned can be null if the session is not detected which can happen in the event a user is not signed-in or has logged out.
*
* **IMPORTANT:** This method loads values directly from the storage attached
* to the client. If that storage is based on request cookies for example,
* the values in it may not be authentic and therefore it's strongly advised
* against using this method and its results in such circumstances. A warning
* will be emitted if this is detected. Use {@link GoTrueClient.getUser} instead.
*
* @category Auth
*
* @remarks
* - Since the introduction of [asymmetric JWT signing keys](/docs/guides/auth/signing-keys), this method is considered low-level and we encourage you to use `getClaims()` or `getUser()` instead.
* - Retrieves the current [user session](/docs/guides/auth/sessions) from the storage medium (local storage, cookies).
* - The session contains an access token (signed JWT), a refresh token and the user object.
* - If the session's access token is expired or is about to expire, this method will use the refresh token to refresh the session.
* - When using in a browser, or you've called `startAutoRefresh()` in your environment (React Native, etc.) this function always returns a valid access token without refreshing the session itself, as this is done in the background. This function returns very fast.
* - **IMPORTANT SECURITY NOTICE:** If using an insecure storage medium, such as cookies or request headers, the user object returned by this function **must not be trusted**. Always verify the JWT using `getClaims()` or your own JWT verification library to securely establish the user's identity and access. You can also use `getUser()` to fetch the user object directly from the Auth server for this purpose.
* - Cross-tab refresh races are handled by the GoTrue server (the rotated token from the first tab is returned to subsequent tabs via the parent-of-active mechanism), so no client-side serialization is needed.
*
* @example Get the session data
* ```js
* const { data, error } = await supabase.auth.getSession()
* ```
*
* @exampleResponse Get the session data
* ```json
* {
* "data": {
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "token_type": "bearer",
* "expires_in": 3600,
* "expires_at": 1700000000,
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* }
* }
* },
* "error": null
* }
* ```
*/
getSession(): Promise<{
data: {
session: Session;
};
error: null;
} | {
data: {
session: null;
};
error: AuthError;
} | {
data: {
session: null;
};
error: null;
}>;
/**
* Acquires a global lock based on the storage key.
*
* TODO(v3): remove along with the legacy lock path. Only called when
* `this.lock` is non-null (custom lock supplied via constructor). The
* default lockless path bypasses this entirely.
*/
private _acquireLock;
/**
* Use instead of {@link GoTrueClient.getSession} inside the library. Loads the session
* via `__loadSession` (which may trigger a refresh if the access token is
* within the expiry margin) and runs `fn` with the result.
*/
private _useSession;
/**
* NEVER USE DIRECTLY!
*
* Always use `_useSession`.
*/
private __loadSession;
/**
* Gets the current user details if there is an existing session. This method
* performs a network request to the Supabase Auth server, so the returned
* value is authentic and can be used to base authorization rules on.
*
* @param jwt Takes in an optional access token JWT. If no JWT is provided, the JWT from the current session is used.
*
* @category Auth
*
* @remarks
* - This method fetches the user object from the database instead of local session.
* - This method is useful for checking if the user is authorized because it validates the user's access token JWT on the server.
* - Should always be used when checking for user authorization on the server. On the client, you can instead use `getSession().session.user` for faster results. `getSession` is insecure on the server.
*
* @example Get the logged in user with the current existing session
* ```js
* const { data: { user } } = await supabase.auth.getUser()
* ```
*
* @exampleResponse Get the logged in user with the current existing session
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* }
* },
* "error": null
* }
* ```
*
* @example Get the logged in user with a custom access token jwt
* ```js
* const { data: { user } } = await supabase.auth.getUser(jwt)
* ```
*/
getUser(jwt?: string): Promise<UserResponse>;
private _getUser;
/**
* Updates user data for a logged in user.
*
* @category Auth
*
* @remarks
* - In order to use the `updateUser()` method, the user needs to be signed in first.
* - By default, email updates sends a confirmation link to both the user's current and new email.
* To only send a confirmation link to the user's new email, disable **Secure email change** in your project's [email auth provider settings](/dashboard/project/_/auth/providers).
*
* @exampleDescription Update the email for an authenticated user
* Sends a "Confirm Email Change" email to the new address. If **Secure Email Change** is enabled (default), confirmation is also required from the **old email** before the change is applied. To skip dual confirmation and apply the change after only the new email is verified, disable **Secure Email Change** in the [Email Auth Provider settings](/dashboard/project/_/auth/providers?provider=Email).
*
* @example Update the email for an authenticated user
* ```js
* const { data, error } = await supabase.auth.updateUser({
* email: 'new@email.com'
* })
* ```
*
* @exampleResponse Update the email for an authenticated user
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "new_email": "new@email.com",
* "email_change_sent_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* }
* },
* "error": null
* }
* ```
*
* @exampleDescription Update the phone number for an authenticated user
* Sends a one-time password (OTP) to the new phone number.
*
* @example Update the phone number for an authenticated user
* ```js
* const { data, error } = await supabase.auth.updateUser({
* phone: '123456789'
* })
* ```
*
* @example Update the password for an authenticated user
* ```js
* const { data, error } = await supabase.auth.updateUser({
* password: 'new password'
* })
* ```
*
* @exampleDescription Update the user's metadata
* Updates the user's custom metadata.
*
* **Note**: The `data` field maps to the `auth.users.raw_user_meta_data` column in your Supabase database. When calling `getUser()`, the data will be available as `user.user_metadata`.
*
* @example Update the user's metadata
* ```js
* const { data, error } = await supabase.auth.updateUser({
* data: { hello: 'world' }
* })
* ```
*
* @exampleDescription Update the user's password with a nonce
* If **Secure password change** is enabled in your [project's email provider settings](/dashboard/project/_/auth/providers), updating the user's password would require a nonce if the user **hasn't recently signed in**. The nonce is sent to the user's email or phone number. A user is deemed recently signed in if the session was created in the last 24 hours.
*
* @example Update the user's password with a nonce
* ```js
* const { data, error } = await supabase.auth.updateUser({
* password: 'new password',
* nonce: '123456'
* })
* ```
*/
updateUser(attributes: UserAttributes, options?: {
emailRedirectTo?: string | undefined;
}): Promise<UserResponse>;
protected _updateUser(attributes: UserAttributes, options?: {
emailRedirectTo?: string | undefined;
}): Promise<UserResponse>;
/**
* Sets the session data from the current session. If the current session is expired, setSession will take care of refreshing it to obtain a new session.
* If the refresh token or access token in the current session is invalid, an error will be thrown.
* @param currentSession The current session that minimally contains an access token and refresh token.
*
* @category Auth
*
* @remarks
* - This method sets the session using an `access_token` and `refresh_token`.
* - If successful, a `SIGNED_IN` event is emitted.
*
* @exampleDescription Set the session
* Sets the session data from an access_token and refresh_token, then returns an auth response or error.
*
* @example Set the session
* ```js
* const { data, error } = await supabase.auth.setSession({
* access_token,
* refresh_token
* })
* ```
*
* @exampleResponse Set the session
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* },
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "11111111-1111-1111-1111-111111111111",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "2024-01-01T00:00:00Z",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* },
* "token_type": "bearer",
* "expires_in": 3500,
* "expires_at": 1700000000
* }
* },
* "error": null
* }
* ```
*/
setSession(currentSession: {
access_token: string;
refresh_token: string;
}): Promise<AuthResponse>;
protected _setSession(currentSession: {
access_token: string;
refresh_token: string;
}): Promise<AuthResponse>;
/**
* Returns a new session, regardless of expiry status.
* Takes in an optional current session. If not passed in, then refreshSession() will attempt to retrieve it from getSession().
* If the current session's refresh token is invalid, an error will be thrown.
* @param currentSession The current session. If passed in, it must contain a refresh token.
*
* @category Auth
*
* @remarks
* - This method will refresh and return a new session whether the current one is expired or not.
*
* @example Refresh session using the current session
* ```js
* const { data, error } = await supabase.auth.refreshSession()
* const { session, user } = data
* ```
*
* @exampleResponse Refresh session using the current session
* ```json
* {
* "data": {
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* },
* "session": {
* "access_token": "<ACCESS_TOKEN>",
* "token_type": "bearer",
* "expires_in": 3600,
* "expires_at": 1700000000,
* "refresh_token": "<REFRESH_TOKEN>",
* "user": {
* "id": "11111111-1111-1111-1111-111111111111",
* "aud": "authenticated",
* "role": "authenticated",
* "email": "example@email.com",
* "email_confirmed_at": "2024-01-01T00:00:00Z",
* "phone": "",
* "confirmed_at": "2024-01-01T00:00:00Z",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "app_metadata": {
* "provider": "email",
* "providers": [
* "email"
* ]
* },
* "user_metadata": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "11111111-1111-1111-1111-111111111111",
* "user_id": "11111111-1111-1111-1111-111111111111",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ],
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "is_anonymous": false
* }
* }
* },
* "error": null
* }
* ```
*
* @example Refresh session using a refresh token
* ```js
* const { data, error } = await supabase.auth.refreshSession({ refresh_token })
* const { session, user } = data
* ```
*/
refreshSession(currentSession?: {
refresh_token: string;
}): Promise<AuthResponse>;
protected _refreshSession(currentSession?: {
refresh_token: string;
}): Promise<AuthResponse>;
/**
* Gets the session data from a URL string
*/
private _getSessionFromURL;
/**
* Checks if the current URL contains parameters given by an implicit oauth grant flow (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.2)
*
* If `detectSessionInUrl` is a function, it will be called with the URL and params to determine
* if the URL should be processed as a Supabase auth callback. This allows users to exclude
* URLs from other OAuth providers (e.g., Facebook Login) that also return access_token in the fragment.
*/
private _isImplicitGrantCallback;
/**
* Checks if the current URL and backing storage contain parameters given by a PKCE flow
*/
private _isPKCECallback;
/**
* Inside a browser context, `signOut()` will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a `"SIGNED_OUT"` event.
*
* For server-side management, you can revoke all refresh tokens for a user by passing a user's JWT through to `auth.api.signOut(JWT: string)`.
* There is no way to revoke a user's access token jwt until it expires. It is recommended to set a shorter expiry on the jwt for this reason.
*
* If using `others` scope, no `SIGNED_OUT` event is fired!
*
* **Warning:** the default `scope` is `'global'`. This signs the user out of
* **every device they are currently signed in on**, not just the current
* tab/session. If you only want to sign the user out of the current session
* (the behavior most other auth libraries default to), pass
* `{ scope: 'local' }` explicitly.
*
* @category Auth
*
* @remarks
* - In order to use the `signOut()` method, the user needs to be signed in first.
* - By default, `signOut()` uses the **global** scope, which signs out the user
* on every device they are signed in on (not just the current one). Pass
* `{ scope: 'local' }` to only sign out the current session. This is
* usually what apps want on a "Sign out" button, especially when users
* sign in from multiple devices and do not expect signing out of one to
* terminate the others.
* - Since Supabase Auth uses JWTs for authentication, the access token JWT will be valid until it's expired. When the user signs out, Supabase revokes the refresh token and deletes the JWT from the client-side. This does not revoke the JWT and it will still be valid until it expires.
*
* @example Sign out of every device (global – default)
* ```js
* const { error } = await supabase.auth.signOut()
* ```
*
* @example Sign out only the current session (recommended for most apps)
* ```js
* const { error } = await supabase.auth.signOut({ scope: 'local' })
* ```
*
* @example Sign out of all other sessions, keep the current one
* ```js
* const { error } = await supabase.auth.signOut({ scope: 'others' })
* ```
*/
signOut(options?: SignOut): Promise<{
error: AuthError | null;
}>;
protected _signOut({ scope }?: SignOut): Promise<{
error: AuthError | null;
}>;
/**
* Receive a notification every time an auth event happens.
* Safe to use without an async function as callback.
*
* @param callback A callback function to be invoked when an auth event happens.
*/
onAuthStateChange(callback: (event: AuthChangeEvent, session: Session | null) => void): {
data: {
subscription: Subscription;
};
};
/**
* Receive a notification every time an auth event happens. Common reentry
* patterns (`getUser`, `setSession`, reading the session from inside a
* handler) complete normally. One hazard remains: calling `refreshSession`
* (or anything that routes through `_callRefreshToken`) from inside a
* `TOKEN_REFRESHED` handler. `refreshingDeferred` resolves only after
* `_notifyAllSubscribers` returns, so the inner refresh dedupes onto the
* outer's unresolved promise and the two wait on each other.
*
* @param callback A callback function to be invoked when an auth event happens.
*
* @deprecated Async callbacks can deadlock when they trigger a nested
* refresh from a `TOKEN_REFRESHED` event. Prefer the sync overload, or move
* refresh-triggering work outside the callback.
*/
onAuthStateChange(callback: (event: AuthChangeEvent, session: Session | null) => Promise<void>): {
data: {
subscription: Subscription;
};
};
private _emitInitialSession;
/**
* Sends a password reset request to an email address. This method supports the PKCE flow.
*
* @param email The email address of the user.
* @param options.redirectTo The URL to send the user to after they click the password reset link.
* @param options.captchaToken Verification token received when the user completes the captcha on the site.
*
* @category Auth
*
* @remarks
* - The password reset flow consist of 2 broad steps: (i) Allow the user to login via the password reset link; (ii) Update the user's password.
* - The `resetPasswordForEmail()` only sends a password reset link to the user's email.
* To update the user's password, see [`updateUser()`](/docs/reference/javascript/auth-updateuser).
* - A `PASSWORD_RECOVERY` event will be emitted when the password recovery link is clicked.
* You can use [`onAuthStateChange()`](/docs/reference/javascript/auth-onauthstatechange) to listen and invoke a callback function on these events.
* - When the user clicks the reset link in the email they are redirected back to your application.
* You can configure the URL that the user is redirected to with the `redirectTo` parameter.
* See [redirect URLs and wildcards](/docs/guides/auth/redirect-urls#use-wildcards-in-redirect-urls) to add additional redirect URLs to your project.
* - After the user has been redirected successfully, prompt them for a new password and call `updateUser()`:
* ```js
* const { data, error } = await supabase.auth.updateUser({
* password: new_password
* })
* ```
*
* @example Reset password
* ```js
* const { data, error } = await supabase.auth.resetPasswordForEmail(email, {
* redirectTo: 'https://example.com/update-password',
* })
* ```
*
* @exampleResponse Reset password
* ```json
* {
* data: {}
* error: null
* }
* ```
*
* @example Reset password (React)
* ```js
* /**
* * Step 1: Send the user an email to get a password reset token.
* * This email contains a link which sends the user back to your application.
* *\/
* const { data, error } = await supabase.auth
* .resetPasswordForEmail('user@email.com')
*
* /**
* * Step 2: Once the user is redirected back to your application,
* * ask the user to reset their password.
* *\/
* useEffect(() => {
* supabase.auth.onAuthStateChange(async (event, session) => {
* if (event == "PASSWORD_RECOVERY") {
* const newPassword = prompt("What would you like your new password to be?");
* const { data, error } = await supabase.auth
* .updateUser({ password: newPassword })
*
* if (data) alert("Password updated successfully!")
* if (error) alert("There was an error updating your password.")
* }
* })
* }, [])
* ```
*/
resetPasswordForEmail(email: string, options?: {
redirectTo?: string;
captchaToken?: string;
}): Promise<{
data: {};
error: null;
} | {
data: null;
error: AuthError;
}>;
/**
* Gets all the identities linked to a user.
*
* @category Auth
*
* @remarks
* - The user needs to be signed in to call `getUserIdentities()`.
*
* @example Returns a list of identities linked to the user
* ```js
* const { data, error } = await supabase.auth.getUserIdentities()
* ```
*
* @exampleResponse Returns a list of identities linked to the user
* ```json
* {
* "data": {
* "identities": [
* {
* "identity_id": "22222222-2222-2222-2222-222222222222",
* "id": "2024-01-01T00:00:00Z",
* "user_id": "2024-01-01T00:00:00Z",
* "identity_data": {
* "email": "example@email.com",
* "email_verified": false,
* "phone_verified": false,
* "sub": "11111111-1111-1111-1111-111111111111"
* },
* "provider": "email",
* "last_sign_in_at": "2024-01-01T00:00:00Z",
* "created_at": "2024-01-01T00:00:00Z",
* "updated_at": "2024-01-01T00:00:00Z",
* "email": "example@email.com"
* }
* ]
* },
* "error": null
* }
* ```
*/
getUserIdentities(): Promise<{
data: {
identities: UserIdentity[];
};
error: null;
} | {
data: null;
error: AuthError;
}>;
/**
* Links an oauth identity to an existing user.
* This method supports the PKCE flow.
*/
linkIdentity(credentials: SignInWithOAuthCredentials): Promise<OAuthResponse>;
/**
* Links an OIDC identity to an existing user.
*/
linkIdentity(credentials: SignInWithIdTokenCredentials): Promise<AuthTokenResponse>;
private linkIdentityOAuth;
private linkIdentityIdToken;
/**
* Unlinks an identity from a user by deleting it. The user will no longer be able to sign in with that identity once it's unlinked.
*
* @category Auth
*
* @remarks
* - The **Enable Manual Linking** option must be enabled from your [project's authentication settings](/dashboard/project/_/auth/providers).
* - The user needs to be signed in to call `unlinkIdentity()`.
* - The user must have at least 2 identities in order to unlink an identity.
* - The identity to be unlinked must belong to the user.
*
* @example Unlink an identity
* ```js
* // retrieve all identities linked to a user
* const identities = await supabase.auth.getUserIdentities()
*
* // find the google identity
* const googleIdentity = identities.find(
* identity => identity.provider === 'google'
* )
*
* // unlink the google identity
* const { error } = await supabase.auth.unlinkIdentity(googleIdentity)
* ```
*/
unlinkIdentity(identity: UserIdentity): Promise<{
data: {};
error: null;
} | {
data: null;
error: AuthError;
}>;
/**
* Generates a new JWT.
* @param refreshToken A valid refresh token that was returned on login.
*/
private _refreshAccessToken;
private _isValidSession;
private _handleProviderSignIn;
/**
* Recovers the session from LocalStorage and refreshes the token
* Note: this method is async to accommodate for AsyncStorage e.g. in React native.
*/
private _recoverAndRefresh;
private _callRefreshToken;
private _notifyAllSubscribers;
/**
* set currentSession and currentUser
* process to _startAutoRefreshToken if possible
*/
private _saveSession;
private _removeSession;
/**
* Removes any registered visibilitychange callback.
*
* {@link GoTrueClient.startAutoRefresh}
* {@link GoTrueClient.stopAutoRefresh}
*/
private _removeVisibilityChangedCallback;
/**
* This is the private implementation of {@link GoTrueClient.startAutoRefresh}. Use this
* within the library.
*/
private _startAutoRefresh;
/**
* This is the private implementation of {@link GoTrueClient.stopAutoRefresh}. Use this
* within the library.
*/
private _stopAutoRefresh;
/**
* Starts an auto-refresh process in the background. The session is checked
* every few seconds. Close to the time of expiration a process is started to
* refresh the session. If refreshing fails it will be retried for as long as
* necessary.
*
* If you set the {@link GoTrueClientOptions#autoRefreshToken} you don't need
* to call this function, it will be called for you.
*
* On browsers the refresh process works only when the tab/window is in the
* foreground to conserve resources as well as prevent race conditions and
* flooding auth with requests. If you call this method any managed
* visibility change callback will be removed and you must manage visibility
* changes on your own.
*
* On non-browser platforms the refresh process works *continuously* in the
* background, which may not be desirable. You should hook into your
* platform's foreground indication mechanism and call these methods
* appropriately to conserve resources.
*
* {@link GoTrueClient.stopAutoRefresh}
*
* @category Auth
*
* @remarks
* - Only useful in non-browser environments such as React Native or Electron.
* - The Supabase Auth library automatically starts and stops proactively refreshing the session when a tab is focused or not.
* - On non-browser platforms, such as mobile or desktop apps built with web technologies, the library is not able to effectively determine whether the application is _focused_ or not.
* - To give this hint to the application, you should be calling this method when the app is in focus and calling `supabase.auth.stopAutoRefresh()` when it's out of focus.
*
* @example Start and stop auto refresh in React Native
* ```js
* import { AppState } from 'react-native'
*
* // make sure you register this only once!
* AppState.addEventListener('change', (state) => {
* if (state === 'active') {
* supabase.auth.startAutoRefresh()
* } else {
* supabase.auth.stopAutoRefresh()
* }
* })
* ```
*/
startAutoRefresh(): Promise<void>;
/**
* Stops an active auto refresh process running in the background (if any).
*
* If you call this method any managed visibility change callback will be
* removed and you must manage visibility changes on your own.
*
* See {@link GoTrueClient.startAutoRefresh} for more details.
*
* @category Auth
*
* @remarks
* - Only useful in non-browser environments such as React Native or Electron.
* - The Supabase Auth library automatically starts and stops proactively refreshing the session when a tab is focused or not.
* - On non-browser platforms, such as mobile or desktop apps built with web technologies, the library is not able to effectively determine whether the application is _focused_ or not.
* - When your application goes in the background or out of focus, call this method to stop the proactive refreshing of the session.
*
* @example Start and stop auto refresh in React Native
* ```js
* import { AppState } from 'react-native'
*
* // make sure you register this only once!
* AppState.addEventListener('change', (state) => {
* if (state === 'active') {
* supabase.auth.startAutoRefresh()
* } else {
* supabase.auth.stopAutoRefresh()
* }
* })
* ```
*/
stopAutoRefresh(): Promise<void>;
/**
* Tears down the client's background work: stops the auto-refresh interval,
* removes the `visibilitychange` listener, closes the cross-tab
* `BroadcastChannel`, and clears registered `onAuthStateChange` subscribers.
*
* Call this from cleanup hooks when the client is being replaced before
* its JS realm is destroyed. React Strict Mode and HMR are the common
* cases. Any in-flight `fetch` calls continue to completion and may still
* write to storage; dispose doesn't abort them or erase storage.
*
* Lifecycle caveat: because in-flight refreshes are not aborted, a
* disposed instance can still persist a rotated session to storage after
* `dispose()` returns. A subsequent `createClient` against the same
* `storageKey` will pick up that session on its next read. If you need
* strict isolation between client lifecycles, await any pending auth
* operation before calling `dispose()` (or change the `storageKey` for
* the replacement client).
*
* Safe to call repeatedly.
*
* @category Auth
*
* @example Cleanup on React unmount
* ```ts
* useEffect(() => {
* const client = createClient(...)
* return () => { client.auth.dispose() }
* }, [])
* ```
*/
dispose(): Promise<void>;
/**
* Runs the auto refresh token tick.
*/
private _autoRefreshTokenTick;
/**
* Registers callbacks on the browser / platform, which in-turn run
* algorithms when the browser window/tab are in foreground. On non-browser
* platforms it assumes always foreground.
*/
private _handleVisibilityChange;
/**
* Callback registered with `window.addEventListener('visibilitychange')`.
*/
private _onVisibilityChanged;
/**
* Generates the relevant login URL for a third-party provider.
* @param options.redirectTo A URL or mobile address to send the user to after they are confirmed.
* @param options.scopes A space-separated list of scopes granted to the OAuth application.
* @param options.queryParams An object of key-value pairs containing query parameters granted to the OAuth application.
*/
private _getUrlForProvider;
private _unenroll;
/**
* {@link GoTrueMFAApi#enroll}
*/
private _enroll;
/**
* {@link GoTrueMFAApi#verify}
*/
private _verify;
/**
* {@link GoTrueMFAApi#challenge}
*/
private _challenge;
/**
* {@link GoTrueMFAApi#challengeAndVerify}
*/
private _challengeAndVerify;
/**
* {@link GoTrueMFAApi#listFactors}
*/
private _listFactors;
/**
* {@link GoTrueMFAApi#getAuthenticatorAssuranceLevel}
*/
private _getAuthenticatorAssuranceLevel;
/**
* Retrieves details about an OAuth authorization request.
* Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
*
* Returns authorization details including client info, scopes, and user information.
* If the response includes only a redirect_url field, it means consent was already given - the caller
* should handle the redirect manually if needed.
*/
private _getAuthorizationDetails;
/**
* Approves an OAuth authorization request.
* Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
*/
private _approveAuthorization;
/**
* Denies an OAuth authorization request.
* Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
*/
private _denyAuthorization;
/**
* Lists all OAuth grants that the authenticated user has authorized.
* Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
*/
private _listOAuthGrants;
/**
* Revokes a user's OAuth grant for a specific client.
* Only relevant when the OAuth 2.1 server is enabled in Supabase Auth.
*/
private _revokeOAuthGrant;
private fetchJwk;
/**
* Extracts the JWT claims present in the access token by first verifying the
* JWT against the server's JSON Web Key Set endpoint
* `/.well-known/jwks.json` which is often cached, resulting in significantly
* faster responses. Prefer this method over {@link GoTrueClient.getUser} which always
* sends a request to the Auth server for each JWT.
*
* If the project is not using an asymmetric JWT signing key (like ECC or
* RSA) it always sends a request to the Auth server (similar to
* {@link GoTrueClient.getUser}) to verify the JWT.
*
* @param jwt An optional specific JWT you wish to verify, not the one you
* can obtain from {@link GoTrueClient.getSession}.
* @param options Various additional options that allow you to customize the
* behavior of this method.
*
* @category Auth
*
* @remarks
* - Parses the user's [access token](/docs/guides/auth/sessions#access-token-jwt-claims) as a [JSON Web Token (JWT)](/docs/guides/auth/jwts) and returns its components if valid and not expired.
* - If your project is using asymmetric JWT signing keys, then the verification is done locally usually without a network request using the [WebCrypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API).
* - A network request is sent to your project's JWT signing key discovery endpoint `https://project-id.supabase.co/auth/v1/.well-known/jwks.json`, which is cached locally. If your environment is ephemeral, such as a Lambda function that is destroyed after every request, a network request will be sent for each new invocation. Supabase provides a network-edge cache providing fast responses for these situations.
* - If the user's access token is about to expire when calling this function, the user's session will first be refreshed before validating the JWT.
* - If your project is using a symmetric secret to sign the JWT, it always sends a request similar to `getUser()` to validate the JWT at the server before returning the decoded token. This is also used if the WebCrypto API is not available in the environment. Make sure you polyfill it in such situations.
* - The returned claims can be customized per project using the [Custom Access Token Hook](/docs/guides/auth/auth-hooks/custom-access-token-hook).
*
* @example Get JWT claims, header and signature
* ```js
* const { data, error } = await supabase.auth.getClaims()
* ```
*
* @exampleResponse Get JWT claims, header and signature
* ```json
* {
* "data": {
* "claims": {
* "aal": "aal1",
* "amr": [{
* "method": "email",
* "timestamp": 1715766000
* }],
* "app_metadata": {},
* "aud": "authenticated",
* "email": "example@email.com",
* "exp": 1715769600,
* "iat": 1715766000,
* "is_anonymous": false,
* "iss": "https://project-id.supabase.co/auth/v1",
* "phone": "+13334445555",
* "role": "authenticated",
* "session_id": "11111111-1111-1111-1111-111111111111",
* "sub": "11111111-1111-1111-1111-111111111111",
* "user_metadata": {}
* },
* "header": {
* "alg": "RS256",
* "typ": "JWT",
* "kid": "11111111-1111-1111-1111-111111111111"
* },
* "signature": [/** Uint8Array *\/],
* },
* "error": null
* }
* ```
*/
getClaims(jwt?: string, options?: {
/**
* @deprecated Please use options.jwks instead.
*/
keys?: JWK[];
/** If set to `true` the `exp` claim will not be validated against the current time. */
allowExpired?: boolean;
/** If set, this JSON Web Key Set is going to have precedence over the cached value available on the server. */
jwks?: {
keys: JWK[];
};
}): Promise<{
data: {
claims: JwtPayload;
header: JwtHeader;
signature: Uint8Array;
};
error: null;
} | {
data: null;
error: AuthError;
} | {
data: null;
error: null;
}>;
/**
* Sign in with a passkey. Handles the full WebAuthn ceremony:
* 1. Fetches authentication challenge from server
* 2. Prompts user via navigator.credentials.get()
* 3. Verifies credential with server and creates session
*
* Requires `auth.experimental.passkey: true`.
*
* @category Auth
*/
signInWithPasskey(credentials?: SignInWithPasskeyCredentials): Promise<AuthPasskeyAuthenticationVerifyResponse>;
/**
* Register a passkey for the current authenticated user. Handles the full WebAuthn ceremony:
* 1. Fetches registration challenge from server
* 2. Prompts user via navigator.credentials.create()
* 3. Verifies credential with server
*
* Requires an active session. Requires `auth.experimental.passkey: true`.
*
* @category Auth
*/
registerPasskey(credentials?: RegisterPasskeyCredentials): Promise<AuthPasskeyRegistrationVerifyResponse>;
/**
* Start passkey registration for the current authenticated user.
* Returns WebAuthn credential creation options to pass to navigator.credentials.create().
*/
private _startPasskeyRegistration;
/**
* Verify passkey registration with the credential response.
* The credentialResponse should be the serialized output of navigator.credentials.create().
*/
private _verifyPasskeyRegistration;
/**
* Start passkey authentication.
* Returns WebAuthn credential request options to pass to navigator.credentials.get().
*/
private _startPasskeyAuthentication;
/**
* Verify passkey authentication and create a session.
* The credential should be the serialized output of navigator.credentials.get().
*/
private _verifyPasskeyAuthentication;
/**
* List all passkeys for the current user.
*/
private _listPasskeys;
/**
* Update a passkey.
*/
private _updatePasskey;
/**
* Delete a passkey.
*/
private _deletePasskey;
}
//# sourceMappingURL=GoTrueClient.d.ts.map |