AuthClient
classAuthentication API for a Linabase project. Exposed via `linabase.auth` on the client returned by `createClient`. Handles sign-up, sign-in (password / magic-link / OAuth), session management, and — when called with a service-role key — server-side admin operations under `auth.admin`. Sessions are persisted in the configured storage (defaults to localStorage in the browser, in-memory in Node). The current access token is automatically attached to every database, storage, and function request.
Examples
const { data, error } = await linabase.auth.signInWithPassword({
email: "alice@example.com",
password: "correct horse battery staple",
});
linabase.auth.onAuthStateChange((event, session) => {
console.log(event, session?.user.email);
});onSessionChange
propertyCallback that the parent LinabaseClient can set to update the Authorization header when the user signs in/out or a token is refreshed.
(session: AuthSession | null) => void | nulladmin
accessormfa
accessorgetSession
methodReturn the current persisted session. Auto-refreshes if the access token is expired and a refresh token is available. Returns `{ session: null }` when the user isn't signed in.
() => Promise<{ data: { session: AuthSession | null }; error: any }>Returns
Promise<{ data: { session: AuthSession | null }; error: any }>
Examples
const { data: { session } } = await linabase.auth.getSession();
if (session) console.log("Signed in as", session.user.email);getUser
methodFetch the current user.
(jwt?: string) => Promise<{ data: { user: AuthUser | null }; error: any }>Parameters
- jwt?: string— Optional access token to use instead of the stored session. Useful for validating a JWT without installing it as the active session (e.g. admin tooling, custom auth bridges).
Returns
Promise<{ data: { user: AuthUser | null }; error: any }>
onAuthStateChange
method(callback: (event: string, session: AuthSession | null) => void) => { unsubscribe: () => void }Parameters
- callback: (event: string, session: AuthSession | null) => void
Returns
{ unsubscribe: () => void }
refreshSession
method() => Promise<{ data: AuthSession | null; error: any }>Returns
Promise<{ data: AuthSession | null; error: any }>
resetPasswordForEmail
method(email: string, _options?: { redirectTo?: string }) => Promise<{ error: any }>Parameters
- email: string
- _options?: { redirectTo?: string }
Returns
Promise<{ error: any }>
setSession
methodSet (or clear) the current session. Three valid shapes: - `null` — clear the session. - Full `AuthSession` — restore a persisted session (e.g. from AsyncStorage). Auto-refreshes if the token is already expired. - `{ access_token, refresh_token, ... }` — token-only, Supabase v2 pattern. Used by OAuth / magic-link callbacks that only have tokens in the URL hash and no user object. The SDK installs the tokens, fetches `/auth/v1/user`, and emits SIGNED_IN. Returns a promise that resolves once the user is populated (or rejects if the token is invalid). Internal callers (signIn, signUp, etc.) pass `_internal=true` to skip the INITIAL_SESSION / SIGNED_IN emit since they emit their own lifecycle events.
(session: AuthSession | SetSessionTokens | null, _internal?: boolean) => void | Promise<{ data: AuthSession | null; error: any }>Parameters
- session: AuthSession | SetSessionTokens | null
- _internal?: boolean
Returns
void | Promise<{ data: AuthSession | null; error: any }>
signIn
methodSign in an existing user with email + password. Alias of signInWithPassword. On success, the session is persisted and subsequent SDK calls use the returned access token automatically.
(params: { email: string; password: string }) => Promise<{ data: AuthSession | null; error: any }>Parameters
- params: { email: string; password: string }
Returns
Promise<{ data: AuthSession | null; error: any }>
Examples
const { data, error } = await linabase.auth.signIn({
email: "alice@example.com",
password: "correct horse battery staple",
});
if (error) console.error(error.message);signInWithIdToken
method(params: { nonce?: string; provider: OAuthProvider; token: string }) => Promise<{ data: AuthSession | null; error: any }>Parameters
- params: { nonce?: string; provider: OAuthProvider; token: string }
Returns
Promise<{ data: AuthSession | null; error: any }>
signInWithOAuth
method(params: { provider: OAuthProvider; redirectTo?: string }) => { url: string }Parameters
- params: { provider: OAuthProvider; redirectTo?: string }
Returns
{ url: string }
signInWithOtp
method(params: { email: string; options?: { emailRedirectTo?: string } }) => Promise<{ data: any; error: any }>Parameters
- params: { email: string; options?: { emailRedirectTo?: string } }
Returns
Promise<{ data: any; error: any }>
signInWithPassword
methodSupabase-compatible alias for signIn
(params: { email: string; password: string }) => Promise<{ data: AuthSession | null; error: any }>Parameters
- params: { email: string; password: string }
Returns
Promise<{ data: AuthSession | null; error: any }>
signOut
methodSign the current user out, clear the persisted session, and revoke the refresh token on the server. Fires a `SIGNED_OUT` event to listeners registered with `onAuthStateChange`.
() => Promise<{ error: any }>Returns
Promise<{ error: any }>
Examples
await linabase.auth.signOut();signUp
methodCreate a new user account with email + password. On success, the user is signed in and the session is persisted. Pass extra metadata via `data`; it is stored on the user record and available later as `user.user_metadata`.
(params: { data?: Record<string, unknown>; email: string; password: string }) => Promise<{ data: AuthSession | null; error: any }>Parameters
- params: { data?: Record<string, unknown>; email: string; password: string }
Returns
Promise<{ data: AuthSession | null; error: any }>
Examples
const { data, error } = await linabase.auth.signUp({
email: "alice@example.com",
password: "correct horse battery staple",
data: { full_name: "Alice" },
});updatePassword
method(newPassword: string) => Promise<{ error: any }>Parameters
- newPassword: string
Returns
Promise<{ error: any }>
updateUser
method(attributes: { data?: Record<string, any>; email?: string; password?: string }) => Promise<{ data: { user: AuthUser | null }; error: any }>Parameters
- attributes: { data?: Record<string, any>; email?: string; password?: string }
Returns
Promise<{ data: { user: AuthUser | null }; error: any }>
verifyOtp
method(params: { email?: string; phone?: string; token: string; type?: "email" | "sms" | "magiclink" | "signup" | "recovery" }) => Promise<{ data: any; error: any }>Parameters
- params: { email?: string; phone?: string; token: string; type?: "email" | "sms" | "magiclink" | "signup" | "recovery" }
Returns
Promise<{ data: any; error: any }>