Developer documentation
Authentication,
Authentication,
already written.
Yours to shape.
Sign-up, sign-in, sessions and organizations, in your brand. Drop in a component, use the hooks, or call the API directly. Your backend verifies tokens offline, so we are never on your request path.
Request
import { SignIn, SignedIn, SignedOut, UserButton } from '@zevauth/react';
export function App() {
return (
<>
<SignedOut><SignIn /></SignedOut>
<SignedIn><UserButton /></SignedIn>
</>
);
}Response
202 Accepted// A complete, branded sign-in.
// Password, magic link, email code and SSO appear
// according to what you enabled in the console.
// no redeploy when you change your mind.Request
import { useAuth, useUser } from '@zevauth/react';
const { user, isLoaded, isSignedIn } = useUser();
const { getToken } = useAuth();
const token = await getToken();Response
202 Accepted// Three states, not two: isLoaded is separate
// from isSignedIn, so a reload never flashes your
// signed-out UI before correcting itself.
//
// getToken() refreshes ahead of expiry for you.Request
curl https://api.zevauth.net/v1/auth/signin \
-H "Authorization: Bearer pk_live_..." \
-H "Content-Type: application/json" \
-d '{
"email": "ada@example.com",
"password": "correct horse battery staple"
}'Response
202 Accepted{
"user": { "id": "user_2xK...", "email": "ada@example.com" },
"session": {
"accessToken": "eyJhbGciOi...",
"refreshToken": "rt_9fQ...",
"expiresIn": 900,
"tokenType": "Bearer"
}
}
From key to signed in
Four steps.
Four steps.
One of them is npm install.
Create a project, copy the publishable key, drop in a component. Development captures the email it would have sent, so you can build the whole flow without an inbox.
Read the full quickstart
~ sign somebody in
# 1. Create a project at console.zevauth.com.
# You get a development environment and a publishable key.
export ZEVAUTH_KEY=pk_test_a1b2c3d4e5f6...
# 2. Install.
npm install @zevauth/react
# 3. Wrap your app, and drop in a sign-in.
# <SignIn /> renders whichever methods your environment
# has enabled, in your brand colours.
# 4. Call your own API with the session token.
curl https://your-app.example.com/api/notes \
-H "Authorization: Bearer $ACCESS_TOKEN"
# Your backend verifies it offline, against our published keys.
# No call to us on the request path.
When you're ready
Read the reference.
Every endpoint, every error code, every webhook event. The reference is the source of truth. Keep it open in a tab while you integrate.
Open the API reference