Create a new client for use in the browser.

NEVER USE DIRECTLY!

Always use {@link #_useSession}.

Acquires a global lock based on the storage key.

Runs the auto refresh token tick.

{@see GoTrueMFAApi#challenge}

{@see GoTrueMFAApi#challengeAndVerify}

Decodes a JWT (without performing any validation).

{@see GoTrueMFAApi#enroll}

{@see GoTrueMFAApi#getAuthenticatorAssuranceLevel}

Gets the session data from a URL string

Generates the relevant login URL for a third-party provider.

Registers callbacks on the browser / platform, which in-turn run algorithms when the browser window/tab are in foreground. On non-browser platforms it assumes always foreground.

IMPORTANT:

1. Never throw in this method, as it is called from the constructor
2. Never return a session from this method as it would be cached over the whole lifetime of the client

Checks if the current URL contains parameters given by an implicit oauth grant flow (https://www.rfc-editor.org/rfc/rfc6749.html#section-4.2)

Checks if the current URL and backing storage contain parameters given by a PKCE flow

{@see GoTrueMFAApi#listFactors}

Callback registered with window.addEventListener('visibilitychange').

Recovers the session from LocalStorage and refreshes Note: this method is async to accommodate for AsyncStorage e.g. in React native.

Generates a new JWT.

Removes any registered visibilitychange callback.

{@see #startAutoRefresh} {@see #stopAutoRefresh}

set currentSession and currentUser process to _startAutoRefreshToken if possible

This is the private implementation of {@link #startAutoRefresh}. Use this within the library.

This is the private implementation of {@link #stopAutoRefresh}. Use this within the library.

Use instead of {@link #getSession} inside the library. It is semantically usually what you want, as getting a session involves some processing afterwards that requires only one client operating on the session at once across multiple tabs or processes.

{@see GoTrueMFAApi#verify}

Used to broadcast state change events to other tabs listening.

Keeps track of the async client initialization. When null or not yet resolved the auth state is unknown Once resolved the the auth state is known and it's save to call any further client methods. Keep extra care to never reject or throw uncaught errors

The storage key used to identify the values saved in localStorage

Namespace for the GoTrue admin methods. These methods should only be used in a trusted server-side environment.

Namespace for the MFA methods.

Log in an existing user by exchanging an Auth Code issued during the PKCE flow.

Returns the session, refreshing it if necessary. The session returned can be null if the session is not detected which can happen in the event a user is not signed-in or has logged out.

Gets the current user details if there is an existing session.

Initializes the client session either from the url or from storage. This method is automatically called when instantiating the client, but should also be called manually when checking for an error from an auth redirect (oauth, magiclink, password recovery, etc).

Receive a notification every time an auth event happens.

Sends a reauthentication OTP to the user's email or phone number. Requires the user to be signed-in.

Returns a new session, regardless of expiry status. Takes in an optional current session. If not passed in, then refreshSession() will attempt to retrieve it from getSession(). If the current session's refresh token is invalid, an error will be thrown.

Resends an existing signup confirmation email, email change email, SMS OTP or phone change OTP.

Sends a password reset request to an email address. This method supports the PKCE flow.

Sets the session data from the current session. If the current session is expired, setSession will take care of refreshing it to obtain a new session. If the refresh token or access token in the current session is invalid, an error will be thrown.

Allows signing in with an OIDC ID token. The authentication provider used should be enabled and configured.

Log in an existing user via a third-party provider. This method supports the PKCE flow.

Log in a user using magiclink or a one-time password (OTP).

If the {{ .ConfirmationURL }} variable is specified in the email template, a magiclink will be sent. If the {{ .Token }} variable is specified in the email template, an OTP will be sent. If you're using phone sign-ins, only an OTP will be sent. You won't be able to send a magiclink for phone sign-ins.

Be aware that you may get back an error message that will not distinguish between the cases where the account does not exist or, that the account can only be accessed via social login.

Do note that you will need to configure a Whatsapp sender on Twilio if you are using phone sign in with the 'whatsapp' channel. The whatsapp channel is not supported on other providers at this time. This method supports PKCE when an email is passed.

Log in an existing user with an email and password or phone and password.

Be aware that you may get back an error message that will not distinguish between the cases where the account does not exist or that the email/phone and password combination is wrong or that the account can only be accessed via social login.

Attempts a single-sign on using an enterprise Identity Provider. A successful SSO attempt will redirect the current page to the identity provider authorization page. The redirect URL is implementation and SSO protocol specific.

You can use it by providing a SSO domain. Typically you can extract this domain by asking users for their email address. If this domain is registered on the Auth instance the redirect will use that organization's currently active SSO Identity Provider for the login.

If you have built an organization-specific login page, you can use the organization's SSO Identity Provider UUID directly instead.

Inside a browser context, signOut() will remove the logged in user from the browser session and log them out - removing all items from localstorage and then trigger a "SIGNED_OUT" event.

For server-side management, you can revoke all refresh tokens for a user by passing a user's JWT through to auth.api.signOut(JWT: string). There is no way to revoke a user's access token jwt until it expires. It is recommended to set a shorter expiry on the jwt for this reason.

If using others scope, no SIGNED_OUT event is fired!

Creates a new user.

Be aware that if a user account exists in the system you may get back an error message that attempts to hide this information from the user. This method has support for PKCE via email signups. The PKCE flow cannot be used when autoconfirm is enabled.

Starts an auto-refresh process in the background. The session is checked every few seconds. Close to the time of expiration a process is started to refresh the session. If refreshing fails it will be retried for as long as necessary.

If you set the {@link GoTrueClientOptions#autoRefreshToken} you don't need to call this function, it will be called for you.

On browsers the refresh process works only when the tab/window is in the foreground to conserve resources as well as prevent race conditions and flooding auth with requests. If you call this method any managed visibility change callback will be removed and you must manage visibility changes on your own.

On non-browser platforms the refresh process works continuously in the background, which may not be desirable. You should hook into your platform's foreground indication mechanism and call these methods appropriately to conserve resources.

{@see #stopAutoRefresh}

Stops an active auto refresh process running in the background (if any).

If you call this method any managed visibility change callback will be removed and you must manage visibility changes on your own.

See {@link #startAutoRefresh} for more details.

Updates user data for a logged in user.

Log in a user given a User supplied OTP or TokenHash received through mobile or email.