The client already stores and refreshes the session. In React you only need to mirror it into state and guard routes.

A context

Wrap your app once: <AuthProvider><App /></AuthProvider>. loading is true until the first event arrives, which happens right away with the stored session. Don’t redirect while it is true, or signed-in people see the sign-in page flash.

Guard a route

Guard by role

This only decides what to show. The access rules protect the data.

Sign-in page

After a successful call, onAuthStateChange fires and useAuth updates. Navigate in an effect that watches user:

Show only the methods that are on

Use passkeys_enabled, magic_link_enabled, email_code_enabled and signup_enabled to render the right buttons.

Social sign-in return

On the page that receives the redirect, do nothing special: the client reads the session itself. To show errors, call getSessionFromUrl() once in an effect (see social sign-in).

Account page

Server-rendered React (Next.js and similar)

Server code can’t read localStorage. Two approaches:
  • Keep Pawabase calls in the browser, behind the guard above.
  • On the server, create a client per request with the user’s token: createClient({ url, apiKey, accessToken }). See Node.js.

React quickstart

A full small app.

Sessions

Storage options.