Auth & API Keys
Auth & API Keys
Overview
The Auth resource handles user authentication (sign up, sign in, sign out) and API key management. Authentication uses email/password with session tokens. API keys provide scoped access for SDK operations.
All auth methods are available on r.auth.
Methods
Sign up
Create a new user account with email and password.
Input fields:
Returns: AuthSession
Password requirements:
- Minimum 12 characters
- At least one letter
- At least one number
The session token is returned in the response body. Store it securely — on mobile, use expo-secure-store or the platform keychain. Never store tokens in AsyncStorage or localStorage in production.
Sign in
Input fields:
Error handling:
Get session
Validate a session token and retrieve the associated user. Returns null if the session is invalid or expired.
Sign out
Invalidate a session token.
Create an API key
API keys provide scoped access to the SDK. They are created using a session token (not another API key).
The full API key is only returned once at creation time. Store it immediately in a secure location (environment variable, secrets manager). It cannot be retrieved later.
Input fields:
createApiKey requires a session token (from signIn or signUp), not an API key. This is because creating API keys is a privileged operation that requires active user authentication.
Available scopes
Full example: sign up, create API key, use it
Token storage best practices
Never store API keys or session tokens in:
localStorageorsessionStorage(XSS vulnerable)AsyncStorage(unencrypted on disk)- Source code or git repositories
- Client-side JavaScript bundles