Overview
One package for the browser and the server, with a result type instead of exceptions.
@nulvless/nulvless-js is the only integration point you need. It covers authentication,
authorization checks, account management and communications, and it works the
same way in a browser bundle and in a Node process.
One package, two clients, and the same method names on both — what differs is which namespaces exist and whether the session is stored for you.
npm install @nulvless/nulvless-jsTwo entry points
Which one you use is decided by the key you hold.
createClient | createServerClient | |
|---|---|---|
| Key | Publishable pk-… | Secret sk-… |
| Runs in | Browser | Node, edge runtimes, workers |
| Session storage | Configurable | None |
auth.* | ✓ | ✓ |
auth.factors.* | ✓ | ✓ |
auth.users.* | ✓ | ✓ |
auth.sessions.* | ✓ | ✓ |
auth.security.* | ✓ | ✓ |
auth.challenges.* | ✓ | ✓ |
auth.oauth.* | ✓ | ✓ |
auth.grants.* | — | ✓ |
auth.admin.* | — | ✓ |
comms.* | — | ✓ |
See Clients for how to create each one.
Every call returns a result
No method throws by default. Each returns { data, error }, and exactly one of
the two is set.
const { data, error } = await nulvless.auth.signIn({ email, password });
if (error) {
// error.code, error.message, error.status_code
return;
}
// data.access_token is guaranteed hereField names on the wire are snake_case, and the SDK does not rename them —
access_token, refresh_token, expires_in, status_code. That is deliberate:
what you read in the docs is what you see in a network tab.
One method breaks the pattern. getAccessToken()
returns the token string or null directly, with no result wrapper — there is no
error to check.
See Error handling if you would rather have exceptions, and Exception codes for what each failure means.
What is under auth
| Namespace | For |
|---|---|
auth.* | Sign-up, sign-in, OAuth, tokens, session checks |
auth.users | The signed-in user's own profile and identities |
auth.sessions | Listing and revoking sessions, sudo mode |
auth.factors | MFA enrolment, recovery codes |
auth.challenges | One-time codes and MFA challenges |
auth.security | Password changes and security settings |
auth.add · switch · deselect · list · remove | Multi-account — browser only, opt-in |
auth.grants | Roles, grants and members — server only |
auth.admin | User administration, roles, OAuth apps — server only |
auth.oauth | OAuth provider flows |
And outside auth, on the server client only:
| Namespace | For |
|---|---|
comms.email · comms.sms · comms.templates | Sending and managing messages |
That is the whole surface. createClient exposes only auth;
createServerClient exposes auth and comms. Storage is exported too, but
it is the set of session-persistence adapters, not a namespace you call — see
Storage.