Authentication

Every basefyio project ships with its own authentication service — a dedicated, isolated user directory for your app's end users. These are not the same as your basefyio dashboard account: your customers sign up and sign in to your application, and basefyio issues them JSON Web Tokens (JWTs) you can use to protect data with Row-Level Security.

You get email & password, email verification, password reset, magic links, and social login (Google, GitHub) out of the box — from the SDK or the REST API.

Setup

Install the SDK and create a client with your project ID and anon key (found under Overview → API Keys in the dashboard). The anon key is safe to ship in a browser; data access is still governed by your RLS policies.

npm install basefyio-js

import { createClient } from 'basefyio-js'

const bf = createClient({
  projectId: 'your-project-id',
  apiKey: 'your-anon-key',
})

All auth methods live under bf.auth.

Email & password

Sign a new user up, then sign them in. The SDK stores the session and refreshes it automatically.

// Sign up
const { data, error } = await bf.auth.signUp({
  email: 'jane@example.com',
  password: 'a-strong-password',
  firstName: 'Jane',   // optional
  lastName: 'Doe',     // optional
})

// Sign in
const { data, error } = await bf.auth.signIn({
  email: 'jane@example.com',
  password: 'a-strong-password',
})

// The signed-in user
const { data: user } = await bf.auth.getUser()

// Sign out (clears the local session)
await bf.auth.signOut()

Every method returns { data, error } — check error before using data. One account per email is enforced per project, so a duplicate signUp returns an error.

Sessions & tokens

After sign-in the SDK keeps the session in memory and refreshes the access token before it expires. Read it any time, attach a token to your own backend calls, or react to auth changes:

const session = bf.auth.getSession()
const token = bf.auth.getAccessToken()   // send as: Authorization: Bearer <token>

// React to sign-in / sign-out / token refresh
const { unsubscribe } = bf.auth.onAuthStateChange((event, session) => {
  // event: 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'EMAIL_VERIFIED' | ...
})

Email verification

If Require email verification is on (project → Auth → Settings), new users receive a code by email. Confirm it with the OTP they enter:

const { error } = await bf.auth.verifyEmail('482917')

Password reset

Send a reset code to the user's email, then set a new password with that code:

// 1. Email the user a reset code
await bf.auth.forgotPassword('jane@example.com')

// 2. User enters the code; set the new password
await bf.auth.resetPassword('482917', 'a-new-strong-password')

Magic links (passwordless)

Email a one-time sign-in code, then exchange it for a session:

await bf.auth.sendMagicLink('jane@example.com')
const { data } = await bf.auth.verifyMagicLink('482917')

Social login (Google & GitHub)

Once a provider is enabled for your project (see below), start the flow with signInWithProvider. The browser is redirected to the provider and back to your app:

// Kicks off the redirect to Google / GitHub
await bf.auth.signInWithProvider('google', {
  redirectTo: '/dashboard',   // a path in YOUR app
})

// On the page the user lands back on, finish the flow:
const tokens = bf.auth.handleProviderCallback()  // reads the URL, stores the session

Enabling a provider

In the dashboard open your project → Auth → Providers, pick Google or GitHub, paste the Client ID and Client Secret from the provider's developer console, and enable it.

https://auth.basefyio.com/realms/<your-realm>/broker/google/endpoint

Managing users from the dashboard

Project → Auth → Users lists everyone who has signed up. You can add a user manually (Add User), reset a password, edit their profile, or remove them. Adding a user with an email that already exists is rejected.

REST API

Not using JavaScript? Every method maps to a REST endpoint under /rest/v1/auth/. Send your anon key as the apikey header (or ?apikey= query param).

curl -X POST "https://api.basefyio.com/rest/v1/auth/signin" \
  -H "apikey: YOUR_ANON_KEY" \
  -H "Content-Type: application/json" \
  -d '{"email":"jane@example.com","password":"a-strong-password"}'

Using the token to protect data

Send the user's access token with your data requests and basefyio evaluates your Row-Level Security policies as that user — so people only ever read and write the rows they're allowed to. The SDK attaches the token automatically once the user is signed in.