Authentication

EdgeBase Authentication provides a complete identity solution for your applications. Support email/password, magic link, email OTP, passkeys, phone auth, 13 OAuth providers, anonymous sessions, and MFA out of the box. Sessions are managed via JWT with automatic refresh token rotation, and you can hook into every step of the auth flow with server-side auth hooks to enforce custom business logic.

Auth Methods

📧

Email & Password

PBKDF2 hashing (600K iterations), email verification support

✨

Magic Link

Passwordless email login — click a link, no password needed

🔢

Email OTP

6-digit passwordless codes delivered by email

🌐

OAuth

Google, GitHub, Apple, Discord, and 9 more providers

🪪

Passkeys

WebAuthn login with biometrics and security keys

📱

Phone / SMS

OTP-based phone login — verify identity with a 6-digit SMS code

👤

Anonymous

Instant sign-in with no credentials — upgradeable to full account later

🔐

Multi-Factor Auth

TOTP-based 2FA with recovery codes for extra account security

How Sessions Work

Session Lifecycle

Sign In → Access Token (15 min) + Refresh Token (28 days)
              │
              ▼
     Token expires → SDK auto-refreshes using Refresh Token
              │
              ▼
     New Access Token + New Refresh Token (rotation)

Access Token — Short-lived JWT verified locally (no server round-trip)
Refresh Token — Long-lived, single-use with rotation grace period for concurrent requests
Multi-tab sync — Token refresh broadcasts across browser tabs via BroadcastChannel

Quick Example

// Sign up
const { user } = await client.auth.signUp({
  email: 'user@example.com',
  password: 'securePassword123',
});

// Sign in
const { user } = await client.auth.signIn({
  email: 'user@example.com',
  password: 'securePassword123',
});

// Get current user
const user = client.auth.currentUser;

// Listen for auth state changes
client.auth.onAuthStateChange((user) => {
  console.log('Auth state:', user ? 'signed in' : 'signed out');
});

Custom Claims

Attach custom data to user tokens for role-based access:

// Server-side: set custom claims
await admin.auth.setCustomClaims(userId, {
  role: 'editor',
  plan: 'pro',
});

// Use in access rules:
// access: { update(auth) { return auth?.custom?.role === 'editor' } }