Admin client

The admin client manages the people who sign in to your app (not your Pawabase team): create accounts, disable them, assign roles, end sessions, read sign-in history. It mirrors Studio’s Users & auth → People pages.

It can read and change every user. It needs a secret key; never use it in a browser or app.

Get started

import { createClient } from "@pawabase/client";
import { admin } from "@pawabase/client/admin";

const a = admin(createClient({ url: process.env.PAWABASE_URL!, apiKey: process.env.PAWABASE_SECRET_KEY!, environment: "production" }));

await a.users.create({ email: "ada@example.com", password: "a long passphrase", roles: ["editor"] });
const { data } = await a.users.search({ search: "ada" });
await a.users.update(data[0].id, { disabled: true });

import os
from pawabase import Pawabase

pb = Pawabase(os.environ["PAWABASE_URL"], os.environ["PAWABASE_SECRET_KEY"], environment="production")

pb.admin.users.create(email="ada@example.com", password="a long passphrase", roles=["editor"])
found = pb.admin.users.search(search="ada")["data"]
pb.admin.users.update(found[0]["id"], disabled=True)

Another environment: a.withEnvironment("staging") / pb.admin.environment("staging").

Users

Call	Does
`users.search({ search, status, limit, offset })`	Find people. `status`: `disabled`, `unverified`, `locked`, `mfa`, `no_mfa`
`users.getUser(id)`	One person
`users.create({...})`	Create an account without sign-up restrictions (`email`, `password`, `username`, `name`, `emailVerified` (default true), `userMetadata`, `appMetadata`, `roles`)
`users.update(id, {...})`	`name`, `emailVerified`, `disabled`, `password`, `userMetadata`, `appMetadata`, `roles` (replaces), `unlock`
`users.deleteUser(id)`	Remove the account
`users.history(id)`	Recent sign-ins and security events
`users.activity(id, { weeks })`	What they did over the last `weeks` weeks (max 53): counts per day by kind (`signin`, `account`, `request`), totals, and a summary (last seen, failures, busiest hour, top routes)
`users.timeline(id, { type, limit, before })`	Sign-ins, account changes and requests in one feed, newest first. `type`: `signin`, `account`, `request`. Pass `next_before` from the answer as `before` for the next page
`users.exportData(id)`	A data-access request: everything the sign-in service holds about them, as JSON. See Data requests
`users.eraseData(id, confirm)`	An erasure request. Final. `confirm` is their email address
`privacy.requests({ limit })`	The exports and erasures handled so far (records hold no personal data)
`users.resetMfa(id)`	Remove their second factors
`users.grant(id, perms)` / `revoke`	Direct permissions
`users.revokeSessions(id)` / `revokeSession(id, sessionId)`	Sign out
`users.devices(id)` / `forgetDevice`	Trusted devices
`users.apiKeys(id)`	Their personal API keys (never the secrets)

Python uses snake_case (get_user, reset_mfa, revoke_sessions, delete_user, api_keys, export_data, erase_data(user_id, confirm=…)).

Roles, organizations, invitations

await a.roles.define("editor", ["posts:read", "posts:write"], { description: "Can write posts" });
await a.orgs.create("acme", "Acme Inc", { ownerEmail: "ada@example.com" });
await a.orgs.addMember("acme", { email: "grace@example.com", role: "admin" });
await a.orgs.invite("acme", { email: "new@example.com", role: "member", redirectTo: "https://myapp.com/invite" });
const { data: pending } = await a.invitations.list();

pb.admin.roles.put("editor", ["posts:read", "posts:write"], description="Can write posts")
pb.admin.orgs.create("acme", "Acme Inc", owner_email="ada@example.com")
pb.admin.orgs.add_member("acme", email="grace@example.com", role="admin")
pb.admin.orgs.invite("acme", email="new@example.com", role="member", redirect_to="https://myapp.com/invite")

Sessions, devices, keys, insight

Call	Does
`sessions.list({ limit })`, `sessions.revoke(family)`	Active sessions across users
`devices.list`, `apiKeys.list`, `apiKeys.revoke(id)`	Devices and user API keys
`insight.events({ kind, failed, limit })`	Sign-in and security events
`insight.stats()`	Counts of users, sign-ins, MFA use, failures
`insight.backup()` / `insight.restore(doc, { replace, dryRun })`	Export and import identities
`insight.previewTokenProfile(profile, userId, { org })`	See what a token profile would contain

See Users, Roles, Organizations, Import and export for the Studio side.

Examples

Onboard a customer

await a.orgs.create(customer.slug, customer.name, { ownerEmail: customer.ownerEmail, metadata: { plan: customer.plan } });

pb.admin.orgs.create(customer["slug"], customer["name"], owner_email=customer["owner_email"], metadata={"plan": customer["plan"]})

React to a plan change

await a.users.update(userId, { roles: ["member", "pro"], appMetadata: { plan: "pro" } });
await a.users.revokeSessions(userId);        // optional: apply it immediately

pb.admin.users.update(user_id, roles=["member", "pro"], app_metadata={"plan": "pro"})
pb.admin.users.revoke_sessions(user_id)

Management client

Definitions and operations.

Users

The Studio pages.

Overview

Infrastructure as code

Define your backend

Logic and events

Files and mail

Ship it

Reference

SDK clients

Get started

Users

Roles, organizations, invitations

Sessions, devices, keys, insight

Examples

Onboard a customer

React to a plan change

Management client

Users

​Get started

​Users

​Roles, organizations, invitations

​Sessions, devices, keys, insight

​Examples

​Onboard a customer

​React to a plan change

Management client

Users

Get started

Users

Roles, organizations, invitations

Sessions, devices, keys, insight

Examples

Onboard a customer

React to a plan change