Private
__loadNEVER USE DIRECTLY!
Always use #_useSession.
Private
_acquireAcquires a global lock based on the storage key.
Private
_autoRuns the auto refresh token tick.
Private
_callPrivate
_challenge{@see GoTrueMFAApi#challenge}
Private
_challenge{@see GoTrueMFAApi#challengeAndVerify}
Private
_debugPrivate
_emitPrivate
_enroll{@see GoTrueMFAApi#enroll}
Private
_exchangePrivate
_get{@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}
Private
_getGets the session data from a URL string
Private
_getGenerates the relevant login URL for a third-party provider.
A URL or mobile address to send the user to after they are confirmed.
A space-separated list of scopes granted to the OAuth application.
An object of key-value pairs containing query parameters granted to the OAuth application.
Private
_getPrivate
_handlePrivate
_handleRegisters callbacks on the browser / platform, which in-turn run algorithms when the browser window/tab are in foreground. On non-browser platforms it assumes always foreground.
Private
_initializeIMPORTANT:
Private
_isChecks if the current URL contains parameters given by an implicit oauth grant flow (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.2)
Private
_isPKCECallbackChecks if the current URL and backing storage contain parameters given by a PKCE flow
Private
_isPrivate
_list{@see GoTrueMFAApi#listFactors}
Private
_notifyPrivate
_onCallback registered with window.addEventListener('visibilitychange')
.
Private
_reauthenticatePrivate
_recoverRecovers the session from LocalStorage and refreshes the token Note: this method is async to accommodate for AsyncStorage e.g. in React native.
Private
_refreshGenerates a new JWT.
A valid refresh token that was returned on login.
Private
_removePrivate
_removeRemoves any registered visibilitychange callback.
{@see #startAutoRefresh} {@see #stopAutoRefresh}
Private
_saveset currentSession and currentUser process to _startAutoRefreshToken if possible
Private
_startThis is the private implementation of #startAutoRefresh. Use this within the library.
Private
_stopThis is the private implementation of #stopAutoRefresh. Use this within the library.
Private
_unenrollPrivate
_useUse instead of #getSession inside the library. It is semantically usually what you want, as getting a session involves some processing afterwards that requires only one client operating on the session at once across multiple tabs or processes.
Private
_verify{@see GoTrueMFAApi#verify}
Namespace for the GoTrue admin methods. These methods should only be used in a trusted server-side environment.
Protected
autoProtected
autoProtected
broadcastUsed to broadcast state change events to other tabs listening.
Protected
detectProtected
fetchOptional
init: RequestInitPrivate
fetchProtected
flowProtected
hasProtected
headersProtected
initializeKeeps track of the async client initialization.
When null or not yet resolved the auth state is unknown
Once resolved the the auth state is known and it's save to call any further client methods.
Keep extra care to never reject or throw uncaught errors
Private
instanceIDProtected
lockProtected
lockProtected
logProtected
loggerRest
...args: any[]Protected
memoryNamespace for the MFA methods.
Protected
pendingProtected
persistProtected
refreshingPrivate
signProtected
stateProtected
storageProtected
storageThe storage key used to identify the values saved in localStorage
Protected
suppressProtected
urlProtected
Experimental
userProtected
visibilityStatic
Private
nextProtected
jwksProtected
jwks_Protected
_refreshOptional
currentSession: { Protected
_setProtected
_signProtected
_updateOptional
options: { Optional
emailLog in an existing user by exchanging an Auth Code issued during the PKCE flow.
Extracts the JWT claims present in the access token by first verifying the
JWT against the server's JSON Web Key Set endpoint
/.well-known/jwks.json
which is often cached, resulting in significantly
faster responses. Prefer this method over #getUser which always
sends a request to the Auth server for each JWT.
If the project is not using an asymmetric JWT signing key (like ECC or RSA) it always sends a request to the Auth server (similar to #getUser) to verify the JWT.
Optional
jwt: stringAn optional specific JWT you wish to verify, not the one you can obtain from #getSession.
Optional
options: { Various additional options that allow you to customize the behavior of this method.
Optional
allowIf set to true
the exp
claim will not be validated against the current time.
Optional
jwks?: { If set, this JSON Web Key Set is going to have precedence over the cached value available on the server.
Optional
keys?: JWK[]Please use options.jwks instead.
Returns the session, refreshing it if necessary.
The session returned can be null if the session is not detected which can happen in the event a user is not signed-in or has logged out.
IMPORTANT: This method loads values directly from the storage attached to the client. If that storage is based on request cookies for example, the values in it may not be authentic and therefore it's strongly advised against using this method and its results in such circumstances. A warning will be emitted if this is detected. Use #getUser() instead.
Gets the current user details if there is an existing session. This method performs a network request to the Supabase Auth server, so the returned value is authentic and can be used to base authorization rules on.
Optional
jwt: stringTakes in an optional access token JWT. If no JWT is provided, the JWT from the current session is used.
Gets all the identities linked to a user.
Initializes the client session either from the url or from storage. This method is automatically called when instantiating the client, but should also be called manually when checking for an error from an auth redirect (oauth, magiclink, password recovery, etc).
Links an oauth identity to an existing user. This method supports the PKCE flow.
Receive a notification every time an auth event happens.
A callback function to be invoked when an auth event happens.
Sends a reauthentication OTP to the user's email or phone number. Requires the user to be signed-in.
Returns a new session, regardless of expiry status. Takes in an optional current session. If not passed in, then refreshSession() will attempt to retrieve it from getSession(). If the current session's refresh token is invalid, an error will be thrown.
Optional
currentSession: { The current session. If passed in, it must contain a refresh token.
Resends an existing signup confirmation email, email change email, SMS OTP or phone change OTP.
Sends a password reset request to an email address. This method supports the PKCE flow.
The email address of the user.
Optional
options: { Optional
captchaVerification token received when the user completes the captcha on the site.
Optional
redirectThe URL to send the user to after they click the password reset link.
Sets the session data from the current session. If the current session is expired, setSession will take care of refreshing it to obtain a new session. If the refresh token or access token in the current session is invalid, an error will be thrown.
The current session that minimally contains an access token and refresh token.
Creates a new anonymous user.
A session where the is_anonymous claim in the access token JWT set to true
Optional
credentials: SignInAnonymouslyCredentialsAllows signing in with an OIDC ID token. The authentication provider used should be enabled and configured.
Log in an existing user via a third-party provider. This method supports the PKCE flow.
Log in a user using magiclink or a one-time password (OTP).
If the {{ .ConfirmationURL }}
variable is specified in the email template, a magiclink will be sent.
If the {{ .Token }}
variable is specified in the email template, an OTP will be sent.
If you're using phone sign-ins, only an OTP will be sent. You won't be able to send a magiclink for phone sign-ins.
Be aware that you may get back an error message that will not distinguish between the cases where the account does not exist or, that the account can only be accessed via social login.
Do note that you will need to configure a Whatsapp sender on Twilio if you are using phone sign in with the 'whatsapp' channel. The whatsapp channel is not supported on other providers at this time. This method supports PKCE when an email is passed.
Log in an existing user with an email and password or phone and password.
Be aware that you may get back an error message that will not distinguish between the cases where the account does not exist or that the email/phone and password combination is wrong or that the account can only be accessed via social login.
Attempts a single-sign on using an enterprise Identity Provider. A successful SSO attempt will redirect the current page to the identity provider authorization page. The redirect URL is implementation and SSO protocol specific.
You can use it by providing a SSO domain. Typically you can extract this domain by asking users for their email address. If this domain is registered on the Auth instance the redirect will use that organization's currently active SSO Identity Provider for the login.
If you have built an organization-specific login page, you can use the organization's SSO Identity Provider UUID directly instead.
Signs in a user by verifying a message signed by the user's private key. Only Solana supported at this time, using the Sign in with Solana standard.
Inside a browser context, signOut()
will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a "SIGNED_OUT"
event.
For server-side management, you can revoke all refresh tokens for a user by passing a user's JWT through to auth.api.signOut(JWT: string)
.
There is no way to revoke a user's access token jwt until it expires. It is recommended to set a shorter expiry on the jwt for this reason.
If using others
scope, no SIGNED_OUT
event is fired!
Optional
options: SignOutCreates a new user.
Be aware that if a user account exists in the system you may get back an error message that attempts to hide this information from the user. This method has support for PKCE via email signups. The PKCE flow cannot be used when autoconfirm is enabled.
A logged-in session if the server has "autoconfirm" ON
A user if the server has "autoconfirm" OFF
Starts an auto-refresh process in the background. The session is checked every few seconds. Close to the time of expiration a process is started to refresh the session. If refreshing fails it will be retried for as long as necessary.
If you set the GoTrueClientOptions#autoRefreshToken you don't need to call this function, it will be called for you.
On browsers the refresh process works only when the tab/window is in the foreground to conserve resources as well as prevent race conditions and flooding auth with requests. If you call this method any managed visibility change callback will be removed and you must manage visibility changes on your own.
On non-browser platforms the refresh process works continuously in the background, which may not be desirable. You should hook into your platform's foreground indication mechanism and call these methods appropriately to conserve resources.
{@see #stopAutoRefresh}
Stops an active auto refresh process running in the background (if any).
If you call this method any managed visibility change callback will be removed and you must manage visibility changes on your own.
See #startAutoRefresh for more details.
Unlinks an identity from a user by deleting it. The user will no longer be able to sign in with that identity once it's unlinked.
Updates user data for a logged in user.
Optional
options: { Optional
emailLog in a user given a User supplied OTP or TokenHash received through mobile or email.
Generated using TypeDoc
Create a new client for use in the browser.