GoTrueClient

class GoTrueClient {

constructor(options: GoTrueClientOptions);

private __loadSession;

private _acquireLock;

private _autoRefreshTokenTick;

private _callRefreshToken;

private _challenge;

private _challengeAndVerify;

private _debug;

private _decodeJWT;

private _emitInitialSession;

private _enroll;

private _exchangeCodeForSession;

private _getAuthenticatorAssuranceLevel;

private _getSessionFromURL;

private _getUrlForProvider;

private _getUser;

private _handleProviderSignIn;

private _handleVisibilityChange;

private _initialize;

private _isImplicitGrantFlow;

private _isPKCEFlow;

private _isValidSession;

private _listFactors;

private _notifyAllSubscribers;

private _onVisibilityChanged;

private _reauthenticate;

private _recoverAndRefresh;

private _refreshAccessToken;

private _removeSession;

private _removeVisibilityChangedCallback;

private _saveSession;

private _startAutoRefresh;

private _stopAutoRefresh;

private _unenroll;

private _useSession;

private _verify;

private instanceID;

protected autoRefreshTicker: ReturnType<setInterval> | null;

protected autoRefreshToken: boolean;

protected broadcastChannel: BroadcastChannel | null;

protected detectSessionInUrl: boolean;

protected fetch: Fetch;

protected flowType: AuthFlowType;

protected headers: {

[key: string]: string;

};

protected initializePromise: Promise<InitializeResult> | null;

protected insecureGetSessionWarningShown: boolean;

protected lock: LockFunc;

protected lockAcquired: boolean;

protected logDebugMessages: boolean;

protected logger: (message: string, ...args: any[]) => void;

protected memoryStorage: {

[key: string]: string;

} | null;

protected pendingInLock: Promise<any>[];

protected persistSession: boolean;

protected refreshingDeferred: Deferred<CallRefreshTokenResult> | null;

protected stateChangeEmitters: Map<string, Subscription>;

protected storage: SupportedStorage;

protected storageKey: string;

protected url: string;

protected visibilityChangedCallback: (() => Promise<any>) | null;

admin: GoTrueAdminApi;

mfa: GoTrueMFAApi;

protected _refreshSession(currentSession?: {

refresh_token: string;

}): Promise<AuthResponse>;

protected _setSession(currentSession: {

access_token: string;

refresh_token: string;

}): Promise<AuthResponse>;

protected _signOut({ scope }?: SignOut): Promise<{

error: AuthError | null;

}>;

protected _updateUser(attributes: UserAttributes, options?: {

emailRedirectTo?: string | undefined;

}): Promise<UserResponse>;

exchangeCodeForSession(authCode: string): Promise<AuthTokenResponse>;

getSession(): Promise<{

data: {

session: Session;

};

error: null;

} | {

data: {

session: null;

};

error: AuthError;

} | {

data: {

session: null;

};

error: null;

}>;

getUser(jwt?: string): Promise<UserResponse>;

getUserIdentities(): Promise<{

data: {

identities: UserIdentity[];

};

error: null;

} | {

data: null;

error: AuthError;

}>;

initialize(): Promise<InitializeResult>;

linkIdentity(credentials: SignInWithOAuthCredentials): Promise<OAuthResponse>;

onAuthStateChange(callback: (event: AuthChangeEvent, session: Session | null) => void | Promise<void>): {

data: {

subscription: Subscription;

};

reauthenticate(): Promise<AuthResponse>;

refreshSession(currentSession?: {

refresh_token: string;

}): Promise<AuthResponse>;

resend(credentials: ResendParams): Promise<AuthOtpResponse>;

resetPasswordForEmail(email: string, options?: {

redirectTo?: string;

captchaToken?: string;

}): Promise<{

data: {};

error: null;

} | {

data: null;

error: AuthError;

}>;

setSession(currentSession: {

access_token: string;

refresh_token: string;

}): Promise<AuthResponse>;

signInAnonymously(credentials?: SignInAnonymouslyCredentials): Promise<AuthResponse>;

signInWithIdToken(credentials: SignInWithIdTokenCredentials): Promise<AuthTokenResponse>;

signInWithOAuth(credentials: SignInWithOAuthCredentials): Promise<OAuthResponse>;

signInWithOtp(credentials: SignInWithPasswordlessCredentials): Promise<AuthOtpResponse>;

signInWithPassword(credentials: SignInWithPasswordCredentials): Promise<AuthTokenResponsePassword>;

signInWithSSO(params: SignInWithSSO): Promise<SSOResponse>;

signOut(options?: SignOut): Promise<{

error: AuthError | null;

}>;

signUp(credentials: SignUpWithPasswordCredentials): Promise<AuthResponse>;

startAutoRefresh(): Promise<void>;

stopAutoRefresh(): Promise<void>;

unlinkIdentity(identity: UserIdentity): Promise<{

data: {};

error: null;

} | {

data: null;

error: AuthError;

}>;

updateUser(attributes: UserAttributes, options?: {

emailRedirectTo?: string | undefined;

}): Promise<UserResponse>;

verifyOtp(params: VerifyOtpParams): Promise<AuthResponse>;

static private nextInstanceID;

}

§Constructors

new GoTrueClient(options: GoTrueClientOptions)

[src]

Create a new client for use in the browser.

§Properties

__loadSession

[src]

NEVER USE DIRECTLY!

Always use {@link #_useSession}.

_acquireLock

[src]

Acquires a global lock based on the storage key.

_autoRefreshTokenTick

[src]

Runs the auto refresh token tick.

_callRefreshToken

[src]

_challenge

[src]

{@see GoTrueMFAApi#challenge}

_challengeAndVerify

[src]

{@see GoTrueMFAApi#challengeAndVerify}

_debug

[src]

_decodeJWT

[src]

Decodes a JWT (without performing any validation).

_emitInitialSession

[src]

_enroll

[src]

{@see GoTrueMFAApi#enroll}

_exchangeCodeForSession

[src]

_getAuthenticatorAssuranceLevel

[src]

{@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}

_getSessionFromURL

[src]

Gets the session data from a URL string

_getUrlForProvider

[src]

Generates the relevant login URL for a third-party provider.

_getUser

[src]

_handleProviderSignIn

[src]

_handleVisibilityChange

[src]

Registers callbacks on the browser / platform, which in-turn run algorithms when the browser window/tab are in foreground. On non-browser platforms it assumes always foreground.

_initialize

[src]

IMPORTANT:

Never throw in this method, as it is called from the constructor
Never return a session from this method as it would be cached over the whole lifetime of the client

_isImplicitGrantFlow

[src]

Checks if the current URL contains parameters given by an implicit oauth grant flow (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.2)

_isPKCEFlow

[src]

Checks if the current URL and backing storage contain parameters given by a PKCE flow

_isValidSession

[src]

_listFactors

[src]

{@see GoTrueMFAApi#listFactors}

_notifyAllSubscribers

[src]

_onVisibilityChanged

[src]

Callback registered with window.addEventListener('visibilitychange').

_reauthenticate

[src]

_recoverAndRefresh

[src]

Recovers the session from LocalStorage and refreshes Note: this method is async to accommodate for AsyncStorage e.g. in React native.

_refreshAccessToken

[src]

Generates a new JWT.

_removeSession

[src]

_removeVisibilityChangedCallback

[src]

Removes any registered visibilitychange callback.

{@see #startAutoRefresh} {@see #stopAutoRefresh}

_saveSession

[src]

set currentSession and currentUser process to _startAutoRefreshToken if possible

_startAutoRefresh

[src]

This is the private implementation of {@link #startAutoRefresh}. Use this within the library.

_stopAutoRefresh

[src]

This is the private implementation of {@link #stopAutoRefresh}. Use this within the library.

_unenroll

[src]

_useSession

[src]

Use instead of {@link #getSession} inside the library. It is semantically usually what you want, as getting a session involves some processing afterwards that requires only one client operating on the session at once across multiple tabs or processes.

_verify

[src]

{@see GoTrueMFAApi#verify}

instanceID

[src]

autoRefreshTicker: ReturnType<setInterval> | null

[src]

autoRefreshToken: boolean

[src]

broadcastChannel: BroadcastChannel | null

[src]

Used to broadcast state change events to other tabs listening.

detectSessionInUrl: boolean

[src]

fetch: Fetch

[src]

flowType: AuthFlowType

[src]

headers: {

[key: string]: string;

}

[src]

initializePromise: Promise<InitializeResult> | null

[src]

Keeps track of the async client initialization. When null or not yet resolved the auth state is unknown Once resolved the the auth state is known and it's save to call any further client methods. Keep extra care to never reject or throw uncaught errors

insecureGetSessionWarningShown: boolean

[src]

lock: LockFunc

[src]

lockAcquired: boolean

[src]

logDebugMessages: boolean

[src]

logger: (message: string, ...args: any[]) => void

[src]

memoryStorage: {

[key: string]: string;

} | null

[src]

pendingInLock: Promise<any>[]

[src]

persistSession: boolean

[src]

refreshingDeferred: Deferred<CallRefreshTokenResult> | null

[src]

stateChangeEmitters: Map<string, Subscription>

[src]

storage: SupportedStorage

[src]

storageKey: string

[src]

The storage key used to identify the values saved in localStorage

url: string

[src]

visibilityChangedCallback: (() => Promise<any>) | null

[src]

admin: GoTrueAdminApi

[src]

Namespace for the GoTrue admin methods. These methods should only be used in a trusted server-side environment.

mfa: GoTrueMFAApi

[src]

Namespace for the MFA methods.

§Methods

_refreshSession(currentSession?: {

refresh_token: string;

}): Promise<AuthResponse> protected

[src]

_setSession(currentSession: {

access_token: string;

refresh_token: string;

}): Promise<AuthResponse> protected

[src]

_signOut({ scope }?: SignOut): Promise<{

error: AuthError | null;

}> protected

[src]

_updateUser(attributes: UserAttributes, options?: {

emailRedirectTo?: string | undefined;

}): Promise<UserResponse> protected

[src]

exchangeCodeForSession(authCode: string): Promise<AuthTokenResponse>

[src]

getSession(): Promise<{

data: {

session: Session;

};

error: null;

} | {

data: {

session: null;

};

error: AuthError;

} | {

data: {

session: null;

};

error: null;

[src]

Returns the session, refreshing it if necessary.

The session returned can be null if the session is not detected which can happen in the event a user is not signed-in or has logged out.

IMPORTANT: This method loads values directly from the storage attached to the client. If that storage is based on request cookies for example, the values in it may not be authentic and therefore it's strongly advised against using this method and its results in such circumstances. A warning will be emitted if this is detected. Use {@link #getUser()} instead.

getUser(jwt?: string): Promise<UserResponse>

[src]

Gets the current user details if there is an existing session. This method performs a network request to the Supabase Auth server, so the returned value is authentic and can be used to base authorization rules on.

@param jwt

Takes in an optional access token JWT. If no JWT is provided, the JWT from the current session is used.

getUserIdentities(): Promise<{

data: {

identities: UserIdentity[];

};

error: null;

} | {

data: null;

error: AuthError;

[src]

Gets all the identities linked to a user.

initialize(): Promise<InitializeResult>

[src]

Initializes the client session either from the url or from storage. This method is automatically called when instantiating the client, but should also be called manually when checking for an error from an auth redirect (oauth, magiclink, password recovery, etc).

linkIdentity(credentials: SignInWithOAuthCredentials): Promise<OAuthResponse>

[src]

Links an oauth identity to an existing user. This method supports the PKCE flow.

onAuthStateChange(callback: (event: AuthChangeEvent, session: Session | null) => void | Promise<void>): {

data: {

subscription: Subscription;

};

}

[src]

Receive a notification every time an auth event happens.

@param callback

A callback function to be invoked when an auth event happens.

reauthenticate(): Promise<AuthResponse>

[src]

Sends a reauthentication OTP to the user's email or phone number. Requires the user to be signed-in.

refreshSession(currentSession?: {

refresh_token: string;

}): Promise<AuthResponse>

[src]

Returns a new session, regardless of expiry status. Takes in an optional current session. If not passed in, then refreshSession() will attempt to retrieve it from getSession(). If the current session's refresh token is invalid, an error will be thrown.

@param currentSession

The current session. If passed in, it must contain a refresh token.

resend(credentials: ResendParams): Promise<AuthOtpResponse>

[src]

Resends an existing signup confirmation email, email change email, SMS OTP or phone change OTP.

resetPasswordForEmail(email: string, options?: {

redirectTo?: string;

captchaToken?: string;

}): Promise<{

data: {};

error: null;

} | {

data: null;

error: AuthError;

[src]

Sends a password reset request to an email address. This method supports the PKCE flow.

@param email

The email address of the user.

@param options.redirectTo

The URL to send the user to after they click the password reset link.

@param options.captchaToken

Verification token received when the user completes the captcha on the site.

setSession(currentSession: {

access_token: string;

refresh_token: string;

}): Promise<AuthResponse>

[src]

Sets the session data from the current session. If the current session is expired, setSession will take care of refreshing it to obtain a new session. If the refresh token or access token in the current session is invalid, an error will be thrown.

@param currentSession

The current session that minimally contains an access token and refresh token.

signInAnonymously(credentials?: SignInAnonymouslyCredentials): Promise<AuthResponse>

[src]

Creates a new anonymous user.

@return

A session where the is_anonymous claim in the access token JWT set to true

signInWithIdToken(credentials: SignInWithIdTokenCredentials): Promise<AuthTokenResponse>

[src]

Allows signing in with an OIDC ID token. The authentication provider used should be enabled and configured.

signInWithOAuth(credentials: SignInWithOAuthCredentials): Promise<OAuthResponse>

[src]

signInWithOtp(credentials: SignInWithPasswordlessCredentials): Promise<AuthOtpResponse>

[src]

If the {{ .ConfirmationURL }} variable is specified in the email template, a magiclink will be sent. If the {{ .Token }} variable is specified in the email template, an OTP will be sent. If you're using phone sign-ins, only an OTP will be sent. You won't be able to send a magiclink for phone sign-ins.

Be aware that you may get back an error message that will not distinguish between the cases where the account does not exist or, that the account can only be accessed via social login.

Do note that you will need to configure a Whatsapp sender on Twilio if you are using phone sign in with the 'whatsapp' channel. The whatsapp channel is not supported on other providers at this time. This method supports PKCE when an email is passed.

signInWithPassword(credentials: SignInWithPasswordCredentials): Promise<AuthTokenResponsePassword>

[src]

Be aware that you may get back an error message that will not distinguish between the cases where the account does not exist or that the email/phone and password combination is wrong or that the account can only be accessed via social login.

signInWithSSO(params: SignInWithSSO): Promise<SSOResponse>

[src]

Attempts a single-sign on using an enterprise Identity Provider. A successful SSO attempt will redirect the current page to the identity provider authorization page. The redirect URL is implementation and SSO protocol specific.

You can use it by providing a SSO domain. Typically you can extract this domain by asking users for their email address. If this domain is registered on the Auth instance the redirect will use that organization's currently active SSO Identity Provider for the login.

If you have built an organization-specific login page, you can use the organization's SSO Identity Provider UUID directly instead.

signOut(options?: SignOut): Promise<{

error: AuthError | null;

[src]

Inside a browser context, signOut() will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a "SIGNED_OUT" event.

For server-side management, you can revoke all refresh tokens for a user by passing a user's JWT through to auth.api.signOut(JWT: string). There is no way to revoke a user's access token jwt until it expires. It is recommended to set a shorter expiry on the jwt for this reason.

If using others scope, no SIGNED_OUT event is fired!

signUp(credentials: SignUpWithPasswordCredentials): Promise<AuthResponse>

[src]

Creates a new user.

Be aware that if a user account exists in the system you may get back an error message that attempts to hide this information from the user. This method has support for PKCE via email signups. The PKCE flow cannot be used when autoconfirm is enabled.

@return

A logged-in session if the server has "autoconfirm" ON

@return

A user if the server has "autoconfirm" OFF

startAutoRefresh(): Promise<void>

[src]

Starts an auto-refresh process in the background. The session is checked every few seconds. Close to the time of expiration a process is started to refresh the session. If refreshing fails it will be retried for as long as necessary.

If you set the {@link GoTrueClientOptions#autoRefreshToken} you don't need to call this function, it will be called for you.

On browsers the refresh process works only when the tab/window is in the foreground to conserve resources as well as prevent race conditions and flooding auth with requests. If you call this method any managed visibility change callback will be removed and you must manage visibility changes on your own.

On non-browser platforms the refresh process works continuously in the background, which may not be desirable. You should hook into your platform's foreground indication mechanism and call these methods appropriately to conserve resources.

{@see #stopAutoRefresh}

stopAutoRefresh(): Promise<void>

[src]

Stops an active auto refresh process running in the background (if any).

If you call this method any managed visibility change callback will be removed and you must manage visibility changes on your own.

See {@link #startAutoRefresh} for more details.

unlinkIdentity(identity: UserIdentity): Promise<{

data: {};

error: null;

} | {

data: null;

error: AuthError;