Quickstart

This gets you from an empty project to an authenticated session. It assumes you have a project in the console and its publishable key.

Install the SDK

npm install @nulvless/nulvless-js

Create a client

In the browser you use the publishable key. It is safe to ship — it can only do what the signed-in user could already do.

lib/nulvless.ts

import { createClient } from '@nulvless/nulvless-js';

export const nulvless = createClient(
  'https://<project>.nulvless.co',
  'pk-…',
);

The URL is your environment's issuer. Each environment has its own, so pointing at staging is a matter of changing this value — nothing else in your code moves.

Sign a user up

At least one of email, phone or username is required.

const { data, error } = await nulvless.auth.signUp({
  email: '[email protected]',
  password,
});

Check the response in this order:

data.access_token — authenticated immediately, session stored for you.
data.challenge — a second step is required; pass the code the user received to auth.verifyChallenge.
data.user only — the account exists and is waiting on email or phone confirmation.

Sign them in

const { data, error } = await nulvless.auth.signIn({
  email: '[email protected]',
  password,
});

if (error) {
  // error.code, error.message, error.status_code
  return;
}

Nothing throws. Every method returns { data, error }, and exactly one of them is set.

Read the session

const { data: session } = await nulvless.auth.getSession();

The session carries the user, the device and location it was created from, and whether sudo mode is currently active.

Check what they can do

verify answers a permission question against a resource, without you running a policy engine.

const { data: verified } = await nulvless.auth.verify({
  resource: 'proj_16tbwq34',
  roles: ['owner', 'admin'],
});

You can ask by roles, by scopes, or both.

Fundamentals

The objects behind all of this, and how they relate.

JavaScript SDK

Every client and method, in full.