The primary register/login surface, plus session-lifecycle methods (getUser(), getSession(), logout(), resumeSession()).
Generated directly from @threshold1/auth@0.3.0 — the real, currently-installed package, not hand-typed. Regenerated on every build; if this page and the actual SDK ever disagree, the SDK is right and this page needs a rebuild, not an edit.
get isAuthenticated(): boolean;
Returns true if the SDK currently holds a JWT token in memory. Note: this does not validate the token with the server; use getSession() for a live check.
boolean
register(emailOrOptions): Promise<RegisterResult>;
Attempt registration in order: passkey, magic link, then OTP.
With fallback: "manual", a failed passkey attempt throws
immediately instead of cascading — call registerWithMagic()/
registerWithOtp() yourself. With "automatic"/"smart" (default), any
registration error is treated as a signal to fall through to the
next method in the fixed passkey → magic → otp order. If all
methods fail, the final error is generic.
| string
| {
email: string;
externalUserId?: string;
}
Promise<RegisterResult>
if all registration methods fail
registerPasskey(
email,
externalUserId?,
attemptId?): Promise<void>;
Register a new passkey for the given email address.
Must be called from a browser context (invokes navigator.credentials.create).
string
The user's email address
string
string
Promise<void>
on server-side failures
if the browser credential call fails or user cancels
registerWithMagic(
email,
redirectUrl?,
externalUserId?,
attemptId?): Promise<void>;
Start a magic-link registration flow for the given email address.
The current API exposes the same send endpoint used by magic-link login.
string
The user's email address
string
Where to redirect after verification. See the
constructor's redirectUrl TSDoc for how this is resolved when
omitted.
string
Optional identity-bridge id to link this registration to your own user record. Persisted on the magic-link token and applied when the link is verified.
Note: this only queues the email — there is no authenticated user yet,
so auth.onAfterAuth does NOT fire here (unlike registerPasskey() and
verifyOtp(), which do). It fires once the link is actually verified,
i.e. inside resumeSession() on the page the link redirects back to.
string
Promise<void>
on API failures
registerWithOtp(
email,
externalUserId?,
attemptId?): Promise<void>;
Register with OTP using window.prompt() for code entry.
string
The user's email address
string
Optional identity-bridge id to link this registration to your own user record. Persisted on the OTP code and applied when the code is verified.
string
Promise<void>
Use sendOtp() + verifyOtp() instead to build your own UI. window.prompt() is blocked in iframes and cannot be styled.
login(email?): Promise<LoginResult>;
Attempt authentication with an identifier in order: passkey, magic
link, then OTP (State C). With no identifier, attempts a
discoverable passkey login first (State A/B entry) — see
FallbackMode for how auth.fallback changes what happens on
failure in each case.
string
The user's email address. Omit for a discoverable/ smart-fallback login.
Promise<LoginResult>
if all authentication methods fail (State C, or
State A/B entry with fallback other than "smart")
loginWithPasskey(email, attemptId?): Promise<void>;
Authenticate with an existing passkey and store the resulting JWT.
Must be called from a browser context (invokes navigator.credentials.get). After a successful call, getUser(), getSession(), and logout() are available.
string
The user's email address
string
Promise<void>
on server-side failures
if the browser credential call fails or user cancels
loginWithMagic(
email,
redirectUrl?,
attemptId?): Promise<void>;
Start a magic-link login flow for the given email address.
This requests that the backend issue a magic link to the user's email. The user must complete verification from that link.
string
The user's email address
string
Where to redirect after verification. See the
constructor's redirectUrl TSDoc for how this is resolved when
omitted.
Note: this only queues the email — there is no authenticated user yet,
so auth.onAfterAuth does NOT fire here. It fires once the link is
actually verified, i.e. inside resumeSession() on the page the link
redirects back to.
string
Promise<void>
on API failures
loginWithOtp(email, attemptId?): Promise<void>;
Login with OTP using window.prompt() for code entry.
string
The user's email address
string
Promise<void>
Use sendOtp() + verifyOtp() instead to build your own UI. window.prompt() is blocked in iframes and cannot be styled.
loginDiscoverable(): Promise<LoginResult>;
Login with no email — browser shows passkey picker for this domain. Use this for passkey-first UX where you don't want to ask for email upfront.
If the user cancels or has no passkey, this throws — handle the error
and show an email input for fallback, or use login() (with
fallback: "smart", the default) for the full three-state model
instead of calling this directly.
Promise<LoginResult>
resumeSession(): Promise<UserProfile | null>;
Call this on every page load in your app.
Checks if the URL contains a t1_token parameter (set by threshold1 after magic link verification) and if so, stores the JWT and cleans the URL so the token doesn't stay visible or get bookmarked. Also picks up t1_device_token, when present, into the device-recognition store.
Returns the authenticated user if a t1_token was found and stored, or null if the user is not authenticated via this method.
Usage (call on every page load): const user = await auth.resumeSession() if (user) console.log('Logged in via magic link:', user.email)
Promise<UserProfile | null>
UserProfile | null
getUser(): Promise<UserProfile>;
Fetch the authenticated user's profile (id and email).
Requires a prior successful loginWithPasskey() call.
Promise<UserProfile>
on expired / invalid session or API errors
getSession(): Promise<SessionInfo>;
Fetch metadata about the current session (userId, issuedAt, expiresAt).
Requires a prior successful loginWithPasskey() call.
Promise<SessionInfo>
on expired / invalid session or API errors
logout(): Promise<void>;
Invalidate the current session on the server and clear the in-memory JWT.
After this call the instance is back in its unauthenticated state. Subsequent getUser() / getSession() calls will throw until loginWithPasskey() is called again.
Note: this does NOT revoke the device-recognition token — device recognition is deliberately independent of session logout, so this device stays recognized for the next login. See README for how to fully sign out of all devices.
Requires a prior successful loginWithPasskey() call.
Promise<void>
on API errors
sendOtp(
email,
externalUserId?,
attemptId?): Promise<void>;
Send an OTP code to the given email address. Use this with verifyOtp() to build your own OTP input UI.
string
The user's email address
string
Optional identity-bridge id to link the resulting registration/login to your own user record. Persisted on the OTP code and applied when the code is verified.
string
Promise<void>
verifyOtp(
email,
code,
attemptId?): Promise<UserProfile>;
Verify an OTP code entered by the user. Call this after sendOtp() once the user enters the code in your UI.
Fires auth.onAfterAuth on success, same as every other successful auth path (registerPasskey, loginWithPasskey, loginDiscoverable, resumeSession).
string
The user's email address
string
The 6-digit code entered by the user
string
Promise<UserProfile>
The authenticated user profile
type LoginResult =
| {
method: AuthMethod;
status: "success";
}
| {
status: "identifier_required";
}
| {
channel: "otp";
maskedIdentifier: string;
status: "confirm_required";
};
{
method: AuthMethod;
status: "success";
}
{
status: "identifier_required";
}
State A — no identifier and no recognized device; show an identifier input.
{
channel: "otp";
maskedIdentifier: string;
status: "confirm_required";
}
State B — this device is recognized and has a fallback method enrolled. Show a one-tap confirm ("Send code to {maskedIdentifier}?") — never send automatically. On confirm, call confirmDeviceSend(), then verifyDeviceCode(code) once the user enters the code.
type RegisterResult = object;
method: AuthMethod;
status: "success";
email: string;
optional externalUserId?: string | null;
id: string;
expiresAt: number;
issuedAt: number;
userId: string;
type AuthMethod = "passkey" | "magic" | "otp" | "sms" | "totp" | "backup_codes";