Auth & API Keys
Auth & API Keys
Overview
The Auth resource handles user authentication (sign up, sign in, sign out) and API key management. Authentication uses email/password with session tokens. API keys provide scoped access for SDK operations.
All auth methods are available on r.auth.
Methods
Sign up
Create a new user account with email and password.
Input fields:
Returns: AuthSession
Password requirements:
- 12–128 characters
- At least one lowercase letter, one uppercase letter, one digit, and one symbol
- Not a known compromised password (e.g.
password123!is rejected)
Failing the policy returns a 400 with code WEAK_PASSWORD.
The session token is returned in the response body. Store it securely — on mobile, use expo-secure-store or the platform keychain. Never store tokens in AsyncStorage or localStorage in production.
Sign in
Input fields:
Error handling:
Get session
Validate a session token and retrieve the associated user. Returns null if the session is invalid or expired.
Sign out
Invalidate a session token.
Create an API key
API keys provide scoped access to the SDK. They are created using a session token (not another API key).
The full API key is only returned once at creation time. Store it immediately in a secure location (environment variable, secrets manager). It cannot be retrieved later.
Input fields:
createApiKey requires a session token (from signIn or signUp), not an API key. This is because creating API keys is a privileged operation that requires active user authentication.
Available scopes
This is the complete list of valid scopes. Anything else (e.g. deploy:create, agents:chat) is rejected with an invalid_scope error. Deployments are covered by projects:write; chatting with agents by agents:write; sandbox execution by projects:write.
One-shot onboarding
signUpAndCreateKey collapses sign up + key creation into a single call — the recipe for agents and mobile apps that need to go from nothing to an authenticated client:
signInAndCreateKey(credentials, keyInput) does the same for existing users, and verifyOtpAndCreateKey(otpInput, keyInput) for passwordless OTP flows. All three return { apiKey, user, session }.
Full example: sign up, create API key, use it
Token storage best practices
Never store API keys or session tokens in:
localStorageorsessionStorage(XSS vulnerable)AsyncStorage(unencrypted on disk)- Source code or git repositories
- Client-side JavaScript bundles