A context
<AuthProvider><App /></AuthProvider>.
loading is true until the first event arrives, which happens right away with the stored session. Don’t redirect while it is true, or signed-in people see the sign-in page flash.
Guard a route
Guard by role
Sign-in page
onAuthStateChange fires and useAuth updates. Navigate in an effect that watches user:
Show only the methods that are on
passkeys_enabled, magic_link_enabled, email_code_enabled and signup_enabled to render the right buttons.
Social sign-in return
On the page that receives the redirect, do nothing special: the client reads the session itself. To show errors, callgetSessionFromUrl() once in an effect (see social sign-in).
Account page
Server-rendered React (Next.js and similar)
Server code can’t readlocalStorage. Two approaches:
- Keep Pawabase calls in the browser, behind the guard above.
- On the server, create a client per request with the user’s token:
createClient({ url, apiKey, accessToken }). See Node.js.
React quickstart
A full small app.
Sessions
Storage options.