Email & Password

Built-in email/password authentication with no MAU charges.

Captcha Protection

When captcha is enabled, the Sign Up, Sign In, and Password Reset endpoints are automatically protected by Cloudflare Turnstile. All client SDKs handle token acquisition transparently — no code changes needed.

Sign Up

JavaScript

const { user, accessToken, refreshToken } = await client.auth.signUp({
  email: 'user@example.com',
  password: 'securePassword123',
  data: {
    displayName: 'Jane Doe',
    avatarUrl: 'https://example.com/avatar.jpg',
  },
});

Dart/Flutter

final result = await client.auth.signUp(
  email: 'user@example.com',
  password: 'securePassword123',
  data: {'displayName': 'Jane Doe'},
);

Swift

let result = try await client.auth.signUp(
    email: "user@example.com",
    password: "securePassword123",
    data: ["displayName": "Jane Doe"]
)

Kotlin

val result = client.auth.signUp(
    email = "user@example.com",
    password = "securePassword123",
    data = mapOf("displayName" to "Jane Doe")
)

Java

Map<String, Object> result = client.auth().signUp("user@example.com", "securePassword123",
    Map.of("displayName", "Jane Doe"));

C#

var result = await client.Auth.SignUpAsync("user@example.com", "securePassword123",
    new() { ["displayName"] = "Jane Doe" });

C++

auto result = client.auth().signUp("user@example.com", "securePassword123", "Jane Doe");

Sign In

JavaScript

const { user, accessToken, refreshToken } = await client.auth.signIn({
  email: 'user@example.com',
  password: 'securePassword123',
});

Dart/Flutter

final result = await client.auth.signIn(
  email: 'user@example.com',
  password: 'securePassword123',
);

Swift

let result = try await client.auth.signIn(
    email: "user@example.com",
    password: "securePassword123"
)

Kotlin

val result = client.auth.signIn(
    email = "user@example.com",
    password = "securePassword123"
)

Java

Map<String, Object> result = client.auth().signIn("user@example.com", "securePassword123");

C#

var result = await client.Auth.SignInAsync("user@example.com", "securePassword123");

C++

auto result = client.auth().signIn("user@example.com", "securePassword123");

Sign Out

JavaScript

await client.auth.signOut();

Dart/Flutter

await client.auth.signOut();

Swift

try await client.auth.signOut()

Kotlin

client.auth.signOut()

Java

client.auth().signOut();

C#

await client.Auth.SignOutAsync();

C++

auto result = client.auth().signOut();

Auth State Listener

React to authentication state changes:

JavaScript

client.auth.onAuthStateChange((event, user) => {
  if (event === 'SIGNED_IN') {
    console.log('User signed in:', user.email);
  } else if (event === 'SIGNED_OUT') {
    console.log('User signed out');
  } else if (event === 'TOKEN_REFRESHED') {
    console.log('Token refreshed');
  }
});

Dart/Flutter

client.auth.onAuthStateChange((event, user) {
  if (event == AuthEvent.signedIn) {
    print('User signed in: ${user?.email}');
  }
});

Swift

client.auth.onAuthStateChange { event, user in
    if event == .signedIn {
        print("User signed in: \(user?.email ?? "")")
    }
}

Kotlin

client.auth.onAuthStateChange { event, user ->
    if (event == AuthEvent.SIGNED_IN) {
        println("User signed in: ${user?.email}")
    }
}

Java

client.auth().onAuthStateChange((event, user) -> {
    if ("SIGNED_IN".equals(event)) {
        System.out.println("User signed in: " + user.get("email"));
    }
});

C#

client.Auth.OnAuthStateChange((authEvent, user) => {
    if (authEvent == "SIGNED_IN")
        Console.WriteLine($"User signed in: {user?.Email}");
});

C++

client.auth().onAuthStateChange([](const std::string& event, const eb::User& user) {
    if (event == "SIGNED_IN")
        std::cout << "Signed in: " << user.email << std::endl;
});

Current User

const user = client.auth.currentUser;
// { id, email, displayName, avatarUrl, role, isAnonymous, ... }

Update Profile

await client.auth.updateProfile({
  displayName: 'New Name',
  avatarUrl: 'https://example.com/new-avatar.jpg',
  emailVisibility: 'public',  // 'public' | 'private'
});

Change Password

Change the password for the currently signed-in user. Requires the current password for verification. All existing sessions are revoked and new tokens are issued.

JavaScript

const { user, accessToken, refreshToken } = await client.auth.changePassword({
  currentPassword: 'oldPassword123',
  newPassword: 'newSecurePassword456',
});

Dart/Flutter

final result = await client.auth.changePassword(
  currentPassword: 'oldPassword123',
  newPassword: 'newSecurePassword456',
);

Swift

let result = try await client.auth.changePassword(
    currentPassword: "oldPassword123",
    newPassword: "newSecurePassword456"
)

Kotlin

val result = client.auth.changePassword(
    currentPassword = "oldPassword123",
    newPassword = "newSecurePassword456"
)

Java

Map<String, Object> result = client.auth().changePassword("oldPassword123", "newSecurePassword456");

C#

var result = await client.Auth.ChangePasswordAsync("oldPassword123", "newSecurePassword456");

C++

auto result = client.auth().changePassword("oldPassword123", "newSecurePassword456");

Session Revocation

After a successful password change, all existing sessions are revoked (other devices are signed out). The SDK automatically updates its stored tokens with the new ones returned in the response.

Requirements:

• New password must meet password policy requirements (default: at least 8 characters)
• Current password must be correct
• User must be signed in with email/password (OAuth-only and anonymous accounts cannot use this method)

Error Responses:

Status	Condition
400	Missing currentPassword or newPassword, or new password shorter than 8 characters
401	Not authenticated, or current password is incorrect
403	Account is OAuth-only or anonymous (no password set)

Email Verification

After sign-up, a verification email is sent. The token expires in 24 hours.

JavaScript

await client.auth.verifyEmail(token);

Dart/Flutter

await client.auth.verifyEmail(token);

Swift

try await client.auth.verifyEmail(token)

Kotlin

client.auth.verifyEmail(token)

Java

client.auth().verifyEmail(token);

C#

await client.Auth.VerifyEmailAsync(token);

C++

client.auth().verifyEmail(token);

Password Reset

Request Reset Email

Send a password reset email. The token expires in 1 hour.

JavaScript

await client.auth.requestPasswordReset('user@example.com', {
  redirectUrl: `${window.location.origin}/auth/reset-password`,
  state: 'billing',
});

Dart/Flutter

await client.auth.requestPasswordReset('user@example.com');

Swift

try await client.auth.requestPasswordReset("user@example.com")

Kotlin

client.auth.requestPasswordReset("user@example.com")

Java

client.auth().requestPasswordReset("user@example.com");

C#

await client.Auth.RequestPasswordResetAsync("user@example.com");

C++

client.auth().requestPasswordReset("user@example.com");

On the Web SDK, requestPasswordReset() also accepts redirectUrl or redirectTo plus optional state. The clicked email link includes:

• token
• type=password-reset
• state if provided

If you do not pass a request-specific redirect, EdgeBase falls back to email.resetUrl.

If your project sets auth.allowedRedirectUrls, the redirect must match that allowlist.

Reset Password with Token

await client.auth.resetPassword(token, 'newSecurePassword456');

Token Management

EdgeBase SDKs handle token refresh automatically:

• Access Token — Short-lived (15 min default), sent with every request
• Refresh Token — Long-lived (28 days default), used to get new access tokens
• Auto-refresh — SDK automatically refreshes expired access tokens
• Tab sync — Browser SDK uses BroadcastChannel to prevent multiple tabs from refreshing simultaneously