SDK
Use @elmapicms/js-sdk for Authentication in JavaScript and TypeScript apps.
Install
npm install @elmapicms/js-sdkCreate an auth client
Create a client with projectId. Do not put a project Sanctum API key in the browser for end-user auth.
import { createClient } from '@elmapicms/js-sdk'
const client = createClient({
baseUrl: 'https://your-domain.com/api',
projectId: 'YOUR_PROJECT_UUID',
projectUserAuth: {
autoRefresh: true,
tokenStorage: window.localStorage, // or your adapter
},
})projectUserAuth can also hold accessToken and refreshToken when you restore a session.
Common methods
await client.signUp({
email: '[email protected]',
password: 'secret-password',
display_name: 'Ada',
})
await client.signInWithPassword({
email: '[email protected]',
password: 'secret-password',
})
await client.refreshSession()
await client.me()
await client.signOut()
await client.signOutAll()
await client.changePassword({
current_password: 'old-password',
new_password: 'new-password',
})
await client.resendVerificationEmail({ email: '[email protected]' })
await client.confirmVerificationEmail({ token: 'VERIFICATION_TOKEN' })
await client.listUserApiKeys()
await client.createUserApiKey({ name: 'Mobile app' })
await client.revokeUserApiKey(keyId)Session helpers
const session = await client.getSession()
const user = await client.getUser()
client.onAuthStateChange((event) => {
// signed_in | token_refreshed | signed_out | auth_error
})When autoRefresh is on, the client can refresh after a 401 on auth routes.
Recommended app pattern
- Authenticate with the SDK in the browser or through your BFF.
- Keep CMS project tokens on the server only.
- Let the BFF write content with a project API token after it verifies the user.
See the marketing page and templates for framework examples: