Documentation
ReferenceJavaScript SDKOverview

Overview

One package for the browser and the server, with a result type instead of exceptions.

@nulvless/nulvless-js is the only integration point you need. It covers authentication, authorization checks, account management and communications, and it works the same way in a browser bundle and in a Node process.

One package, two clients, and the same method names on both — what differs is which namespaces exist and whether the session is stored for you.

npm install @nulvless/nulvless-js

Two entry points

Which one you use is decided by the key you hold.

createClientcreateServerClient
KeyPublishable pk-…Secret sk-…
Runs inBrowserNode, edge runtimes, workers
Session storageConfigurableNone
auth.*✓✓
auth.factors.*✓✓
auth.users.*✓✓
auth.sessions.*✓✓
auth.security.*✓✓
auth.challenges.*✓✓
auth.oauth.*✓✓
auth.grants.*—✓
auth.admin.*—✓
comms.*—✓

See Clients for how to create each one.

Every call returns a result

No method throws by default. Each returns { data, error }, and exactly one of the two is set.

const { data, error } = await nulvless.auth.signIn({ email, password });

if (error) {
  // error.code, error.message, error.status_code
  return;
}

// data.access_token is guaranteed here

Field names on the wire are snake_case, and the SDK does not rename them — access_token, refresh_token, expires_in, status_code. That is deliberate: what you read in the docs is what you see in a network tab.

One method breaks the pattern. getAccessToken() returns the token string or null directly, with no result wrapper — there is no error to check.

See Error handling if you would rather have exceptions, and Exception codes for what each failure means.

What is under auth

NamespaceFor
auth.*Sign-up, sign-in, OAuth, tokens, session checks
auth.usersThe signed-in user's own profile and identities
auth.sessionsListing and revoking sessions, sudo mode
auth.factorsMFA enrolment, recovery codes
auth.challengesOne-time codes and MFA challenges
auth.securityPassword changes and security settings
auth.add · switch · deselect · list · removeMulti-account — browser only, opt-in
auth.grantsRoles, grants and members — server only
auth.adminUser administration, roles, OAuth apps — server only
auth.oauthOAuth provider flows

And outside auth, on the server client only:

NamespaceFor
comms.email · comms.sms · comms.templatesSending and managing messages

That is the whole surface. createClient exposes only auth; createServerClient exposes auth and comms. Storage is exported too, but it is the set of session-persistence adapters, not a namespace you call — see Storage.

Next

On this page