The credentials to verify (from extractCredentials).
Allowed auth modes and optional env overrides.
{ data: AuthResult, error: null } on success, { data: null, error: AuthError } on failure.
const credentials = extractCredentials(request)
const { data: auth, error } = await verifyCredentials(credentials, {
auth: ['user', 'publishable'],
})
if (error) {
console.error(error.code, error.message, error.hint)
return Response.json(error.toJSON(), { status: error.status })
}
Verifies pre-extracted credentials against one or more allowed auth modes.
Tries each mode in order — first match wins. A mode is only tried when its credential is present; a JWT that is present but fails verification short-circuits the chain with InvalidJwtError instead of falling through to the next mode. Use verifyAuth to extract and verify in a single call.
When every mode falls through, the returned error names the actual cause rather than a generic failure — MissingCredentialsError when the request carried nothing, InvalidApiKeyError when an
apikeymatched no configured key, or a500(JwksNotConfiguredError, NoKeysConfiguredError) when the server is configured such that no request could ever have succeeded. Every error carrieshint,docs, and non-sensitivedetails.A misconfiguration
500is only reported once nothing has matched, so an allowed mode that does match the request's credentials still wins — e.g.['user', 'secret']with no JWKS but a valid apikey authenticates assecret.sb_*values in the Authorization slot are API keys, not user tokens, and stay a caller error.