The user profile

The profile is what you know about a person: name, picture, email and any extra details. People edit their own from your app; you and your team can edit anyone’s in Studio.

Read the profile

const user = await pawabase.auth.getUser();
user.name; user.email; user.avatar_url; user.user_metadata; user.roles; user.identities;

user = pb.auth.get_user()
user["name"], user["email"], user["avatar_url"], user["user_metadata"]

getUser asks the server; the session’s user is a cached copy that can be a few minutes old.

Update it

await pawabase.auth.updateUser({
  name: "Ada Lovelace",
  avatar_url: "https://…/ada.png",
  data: { theme: "dark", notifications: { email: true } },   // merged into user_metadata
});

pb.auth.update_user(
    name="Ada Lovelace",
    avatar_url="https://…/ada.png",
    data={"theme": "dark", "notifications": {"email": True}},
)

data is merged into user_metadata: only the keys you send change. A successful update fires USER_UPDATED, so components listening with onAuthStateChange refresh themselves. The server event is user.updated. Attributes you marked admin-only in Attributes can’t be changed by the person.

Two kinds of custom data

Field	Who can change it	Use it for
`user_metadata` (Public metadata in Studio)	The person	Preferences, display settings, onboarding state
`app_metadata` and `roles` (Private metadata)	Only your server and Studio	Plans, permissions, anything a rule trusts

Never base access on user_metadata.

An avatar

Send the picture to Pawabase and it does the rest: it stores the image in a public avatars bucket (made for you the first time, if the environment has none), points avatar_url at it, and removes the previous picture.

// `file` is a File from <input type="file">, or any Blob
const user = await pawabase.auth.setAvatar(file);
user.avatar_url;   // https://…/storage/v1/files/production/avatars/<user id>/….png

await pawabase.auth.removeAvatar();

user = pb.auth.set_avatar(open("ada.png", "rb"))   # bytes, an open file or a Path
user["avatar_url"]

pb.auth.remove_avatar()

curl -X PUT "$URL/auth/v1/user/avatar" \
  -H "apikey: $PUBLISHABLE_KEY" -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "content-type: image/png" --data-binary @ada.png

The picture must be a PNG, JPEG, WebP or GIF, and at most 2 MB. A wrong type is 415, a file that is too large is 413, and the bucket also checks what the file really is, not only what it is called. Pictures are served from the gateway with no key, so an <img src={user.avatar_url}> just works. A sign-in with Google or GitHub still fills avatar_url with the provider’s picture until the person uploads their own; a picture you did not upload is never deleted. An administrator can do the same for anyone with the secret key: PUT or DELETE /admin/v1/envs/{env}/users/{id}/avatar.

Where pictures live, and changing it

The bucket is a normal storage bucket, so you can open it in Studio and change its size limit, image types or caching, or rename it. Only the server writes to it: its write policy is service, so your app cannot upload there directly and one person cannot overwrite another’s picture. Reads are public. Three settings under the environment’s auth.directory.avatars control it:

Setting	Default	What it does
`enabled`	`true`	Turn profile pictures off. Uploads answer `403`; `avatar_url` can still be set to an address.
`bucket`	`avatars`	The bucket to use. Point it at a bucket of your own and it is used as it is; nothing is created.
`max_kb`	`2048`	The largest picture, from 16 to 10240 KB.

curl -X PATCH "$URL/platform/v1/envs/production" -H "apikey: $SECRET_KEY" -H "content-type: application/json" \
  -d '{"auth":{"directory":{"avatars":{"bucket":"profile-pictures","max_kb":1024}}}}'

Changes take effect within about ten seconds.

Change the email

await pawabase.auth.updateUser({ email: "new@example.com" });

A confirmation link goes to the new address. See Email verification.

Change the password

Pass the current password with the new one (required for accounts that have one):

await pawabase.auth.updateUser({ current_password: "old", password: "a new long passphrase" });

pb.auth.update_user(current_password="old", password="a new long passphrase")

The new password must satisfy the password policy. The event user.password_changed fires, and the person can be emailed a safety notice (Password changed template).

A profile form

async function save(form: { name: string; theme: string }) {
  try {
    return await pawabase.auth.updateUser({ name: form.name, data: { theme: form.theme } });
  } catch (e) {
    if (e instanceof ValidationError) return e.byField();     // { name: ["too long"] }
    throw e;
  }
}

In Studio

Users → open the person → Profile. Edit name, email and username; upload or remove the picture; Public metadata and Private metadata are JSON editors.

Linked accounts

Social and company identities.

Sign-up form

Collect details at sign-up.

Getting started

Sign-in methods

Sign-up

Security

People

Developers

Read the profile

Update it

Two kinds of custom data

An avatar

Where pictures live, and changing it

Change the email

Change the password

A profile form

In Studio

Linked accounts

Sign-up form

​Read the profile

​Update it

​Two kinds of custom data

​An avatar

​Where pictures live, and changing it

​Change the email

​Change the password

​A profile form

​In Studio

Linked accounts

Sign-up form

Read the profile

Update it

Two kinds of custom data

An avatar

Where pictures live, and changing it

Change the email

Change the password

A profile form

In Studio