JavaScript SDK: auth reference
Every authentication and user-administration method, with its signature.
6 min read·Level reference·Revised on Oct 12, 2026
This English text was generated automatically from the French original and has not been reviewed yet.
#
Functions
Exported functions
| Function | Description |
|---|---|
function isMfaChallenge(v: unknown): v is MfaChallenge | Discriminant type guard LoginResponse = TokenPair | MfaChallenge. |
#
Class
AuthService
| Method | Description |
|---|---|
dispose(): void | Dismantles the proactive lifecycle: ticker, visibility, BroadcastChannel, listeners. |
onAuthStateChange(callback: AuthStateCallback): { unsubscribe: () => void; data: { subscription: { unsubscribe: () => void; }; }; } | Listens for session state changes (SIGNED_IN, SIGNED_OUT, TOKEN_REFRESHED, USER_UPDATED, MFA_CHALLENGE…). |
signUp(req: SignUpRequest): Promise<AuraResponse<LoginResponse>> | Create an account with email and password. |
signInWithPassword(req: SignInRequest): Promise<AuraResponse<LoginResponse>> | Logs in a user by email and password. |
signInWithOAuth(provider: string, options?: OAuthSignInOptions): Promise<AuraResponse<{ url: string; }>> | Starts a OAuth flow: always returns { url } (and additionally redirects the browser if an window exists). |
signInWithMagicLink(req: MagicLinkRequest): Promise<AuraResponse<{ message: string; }>> | Sends a connection link by email (“magic link”). |
signInAnonymously(): Promise<AuraResponse<TokenPair>> | Creates an anonymous session (user without email), recorded and reported by SIGNED_IN. |
signOut(): Promise<AuraResponse<null>> | Disconnect: revokes the server-side refresh token if it exists, flushes the local session, and issues SIGNED_OUT. |
refreshSession(): Promise<AuraResponse<TokenPair>> | Refreshes the session with the refresh token and issues TOKEN_REFRESHED. |
getSession(): Promise<{ data: { session: Session | null; }; error: null; accessToken: string | null; access_token: string | null; user: User | null; }> | Current session read from the store (synchronous in practice, no network call). |
setSession(accessToken: string, refreshToken: string): Promise<AuraResponse<User>> | Installs a session from an existing access token and refresh token (e.g. received from a server). |
exchangeCodeForSession(authCode: string, codeVerifier?: string): Promise<AuraResponse<LoginResponse>> | Exchanges the PKCE authorization code for a session. |
listSessions(): Promise<AuraResponse<SessionInfo[]>> | Lists the logged in user's sessions (device, IP address, dates); is_current locates the current session. |
revokeSession(sessionId: string): Promise<AuraResponse<null>> | Revokes a session of the user connected by their identifier. |
revokeAllSessions(): Promise<AuraResponse<{ message: string; }>> | Logs out the user everywhere: revokes all their sessions, flushes the local session, and issues SIGNED_OUT. |
getUser(jwt?: string): Promise<AuraResponse<User>> | Retrieves the validated user on the server side. |
getClaims(jwt?: string, options?: { allowExpired?: boolean; issuer?: string; audience?: string; }): Promise<AuraResponse<GetClaimsResult>> | Verifies and decodes the claims of a JWT. |
deleteUser(password: string): Promise<AuraResponse<null>> | Deletes the connected user's account after confirmation with their password, then clears the local session. |
updateUser(req: UpdateUserRequest): Promise<AuraResponse<User>> | Updates the logged in user (metadata, password, etc.) and issues USER_UPDATED. |
resetPasswordForEmail(req: PasswordResetRequest): Promise<AuraResponse<{ message: string; }>> | Sends a password reset email. |
updatePassword(newPassword: string, currentPassword?: string): Promise<AuraResponse<User>> | Changes the password of the logged in user. |
mfaEnroll(): Promise<AuraResponse<MfaEnrollResponse>> | MFA: starts TOTP enrollment and returns the secret and the URL otpauth_url to display as a QR code. |
mfaVerifySetup(code: string): Promise<AuraResponse<{ recovery_codes: string[]; }>> | MFA: confirms the enrollment with a first code and returns the recovery codes. |
mfaVerify(req: MfaVerifyRequest): Promise<AuraResponse<TokenPair>> | MFA: terminates a connection that returned a challenge (mfa_token and TOTP code). |
mfaUnenroll(password: string): Promise<AuraResponse<{ message: string; }>> | MFA: deactivates MFA after confirmation with the password. |
verifyOtp(params: VerifyEmailChangeOtpParams): Promise<AuraResponse<User>>verifyOtp(params: Exclude<VerifyOtpParams, VerifyEmailChangeOtpParams>): Promise<AuraResponse<TokenPair>> | SINGLE entry point of OTP verification (parity verifyOtp of @supabase/auth-js). |
resendVerificationEmail(email?: string): Promise<AuraResponse<{ message: string; }>> | Resends the verification email, to email or to the logged in user's address. |
signInWithEmailOtp(email: string): Promise<AuraResponse<{ message: string; }>> | Sends a one-time use code by email; to be confirmed by verifyOtp({ type: 'email' }). |
signInWithSmsOtp(phone: string): Promise<AuraResponse<{ message: string; }>> | Sends a one-time code by SMS; to be confirmed by verifyOtp({ type: 'sms' }). |
listIdentities(): Promise<AuraResponse<IdentityInfo[]>> | Lists the identities (providers) linked to the logged in user. |
linkIdentity(provider: string): Promise<AuraResponse<{ url: string; provider: string; }>> | Starts binding a provider OAuth to the connected account and returns the authorization URL to open. |
unlinkIdentity(identityId: string): Promise<AuraResponse<{ message: string; }>> | Detaches an identity from the account connected by its identifier. |
regenerateRecoveryCodes(code: string): Promise<AuraResponse<{ recovery_codes: string[]; }>> | MFA: regenerates the recovery codes after confirmation with a TOTP code. |
signInWithIdToken(provider: string, idToken: string, accessToken?: string): Promise<AuraResponse<LoginResponse>> | Exchanges a provider token ID (Google/Apple, native mobile) for a session. |
getSettings(): Promise<AuraResponse<{ disable_signup: boolean; external: Record<string, boolean>; mailer_autoconfirm: boolean; mfa_enabled: boolean; }>> | GoTrue parity: GET /settings — public project config (no auth required). |
getAnonKey(): Promise<AuraResponse<{ anon_key: string; }>> | Publishable key (anon key) of the project — GET /anon-key (public, like the Supabase model). |
resetPassword(token: string, newPassword: string): Promise<AuraResponse<TokenPair>> | Consumes the password recovery token and applies the new password. |
promoteAnonymous(credentials: { email: string; password: string; }): Promise<AuraResponse<TokenPair>> | Converts the current anonymous user (JWT required) to a regular email+password account. |
verifyMagicLink(token: string): Promise<AuraResponse<TokenPair>> | Consumes the magic link token and returns a TokenPair. |
#
Class
AuthAdminService
| Method | Description |
|---|---|
listUsers(params?: { limit?: number; offset?: number; search?: string; }): Promise<AuraResponse<AdminUser[]>> | Lists project users, with search (search) and pagination (limit, offset). |
getUser(userId: string): Promise<AuraResponse<AdminUser>> | Reads a user by their ID. |
createUser(data: AdminCreateUserRequest): Promise<AuraResponse<AdminUser>> | Creates a user without going through public registration (email, password, metadata, role). |
updateUser(userId: string, data: AdminUpdateUserRequest): Promise<AuraResponse<AdminUser>> | Updates a user: only the provided fields change. |
deleteUser(userId: string): Promise<AuraResponse<null>> | Delete a user. |
banUser(userId: string): Promise<AuraResponse<null>> | Bans a user: he can no longer log in. |
unbanUser(userId: string): Promise<AuraResponse<null>> | Lift a user's ban. |
generateLink(userId: string, type: GenerateLinkType): Promise<AuraResponse<GenerateLinkResult>> | Generates a one-time link for a user ('magic', 'recovery', or 'invite') and returns { link, token }. |
getUserStats(): Promise<AuraResponse<UserStats>> | User statistics: total, verified, banned, with MFA and new over 7 days. |
listUserIdentities(userId: string): Promise<AuraResponse<IdentityInfo[]>> | Lists identities linked to a user (OAuth providers, email). |
listSessions(params?: { userId?: string; limit?: number; offset?: number; }): Promise<AuraResponse<AdminSessionInfo[]>> | Lists active sessions of all users, filterable by userId, with pagination. |
revokeSession(sessionId: string): Promise<AuraResponse<null>> | Revokes a session by its identifier. |
getAuditLog(params?: { userId?: string; limit?: number; offset?: number; }): Promise<AuraResponse<AuditLogEntry[]>> | Reads the audit log (action, IP address, user agent, date), filterable by userId, with paging. |
getSettings(): Promise<AuraResponse<AuthSettings>> | Reads the project's authentication settings. |
updateSettings(data: AuthSettingsUpdate): Promise<AuraResponse<AuthSettings>> | Updates the auth settings of the project (partial merge: only the provided fields are written, COALESCE on the backend side). |
listEmailTemplates(): Promise<AuraResponse<Record<string, unknown>[]>> | Lists project authentication email templates. |
getEmailTemplate(type: string): Promise<AuraResponse<Record<string, unknown>>> | Reads the email template of a given type (e.g. confirmation, recovery). |
updateEmailTemplate(type: string, data: EmailTemplateUpdate): Promise<AuraResponse<Record<string, unknown>>> | Replaces email template content of a given type. |
deleteEmailTemplate(type: string): Promise<AuraResponse<{ message: string; }>> | Removes the custom template from an email type. |
testEmailTemplate(type: string, body: { to_email: string; }): Promise<AuraResponse<null>> | Sends a test email with a type's template to the address to_email. |
Generated page
This page is generated from the type declarations and comments of the SDK, so it cannot drift from the published code. For worked examples, read the guides.
Last updated · Oct 12, 2026