Authentication

ZendBX provides project-scoped authentication. Every project has its own user store, JWT secret, and session management — completely isolated from other projects.

How It Works

When a user signs up or signs in, ZendBX issues a JWT signed with your project's unique jwt_secret. This token is sent with every request as Authorization: Bearer <token>. The backend decodes it to establish the user's identity for RLS policies.

💡Platform tokens (dashboard logins) are signed with the platform's SECRET_KEY. Project tokens (SDK logins) are signed with the project's jwt_secret. The unified auth resolver accepts both.

typescript

const { data, error } = await db.auth.signUp({
  email: 'user@example.com',
  password: 'password123',
  name: 'Jane Doe',
});
// data.user  — User object
// data.session — Session with access_token

Parameter	Type	Required	Description
email	string	required	User email address.
password	string	required	Minimum 6 characters.
name	string	optional	Display name. Defaults to email prefix.

typescript

const { data, error } = await db.auth.signIn({
  email: 'user@example.com',
  password: 'password123',
});

if (error) {
  // Invalid credentials, rate limited, etc.
  console.error(error.message);
  return;
}

const { user, session } = data;
console.log('Signed in as:', user.email);
console.log('Token:', session.access_token);

Get Current User

typescript

const { data: { user } } = await db.auth.getUser();

if (!user) {
  // Not authenticated
  redirect('/login');
}

Sign Out

typescript

await db.auth.signOut();
// Token cleared from memory and localStorage

Session Persistence

typescript

// Token is automatically persisted to localStorage['zendbx_token']
// On next page load, it's restored automatically

// To opt out of localStorage (SSR / Node.js):
const db = createClient({
  apiUrl, anonKey, projectSlug,
  storageKey: null,  // disables storage
  getAccessToken: () => mySessionStore.getToken(),
});

Password Reset

typescript

// Step 1: Request reset email
await db.auth.resetPassword('user@example.com');

// Step 2: After user clicks email link, update password
await db.auth.updatePassword(token, 'newpassword123');

JWT Structure

ZendBX JWTs are standard HS256 tokens. Here's what the payload looks like:

json

{
  "sub": "user-uuid",
  "email": "user@example.com",
  "role": "authenticated",
  "iss": "zendbx",
  "project_id": "project-uuid",
  "iat": 1718000000,
  "exp": 1718604800
}

⚠️JWTs expire after 7 days. Call db.auth.getSession() to verify the token is still valid. If it returns null, redirect to login.

OAuth Providers

OAuth is configured per-project in the Dashboard → Authentication → Providers. Supported providers: Google, GitHub.

bashGet OAuth redirect URL

# Get OAuth login URL
curl https://api.zendbx.in/oauth/{provider}/login?project_slug=my-project

REST API Examples

bashSign up

curl -X POST https://api.zendbx.in/v1/auth/{project-id}/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","password":"password123","name":"Jane"}'

bashSign in

curl -X POST https://api.zendbx.in/v1/auth/{project-id}/login \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","password":"password123"}'

Authentication

ZendBX provides project-scoped authentication. Every project has its own user store, JWT secret, and session management — completely isolated from other projects.

How It Works

💡Platform tokens (dashboard logins) are signed with the platform's SECRET_KEY. Project tokens (SDK logins) are signed with the project's jwt_secret. The unified auth resolver accepts both.

typescript

const { data, error } = await db.auth.signUp({
  email: 'user@example.com',
  password: 'password123',
  name: 'Jane Doe',
});
// data.user  — User object
// data.session — Session with access_token

Parameter	Type	Required	Description
email	string	required	User email address.
password	string	required	Minimum 6 characters.
name	string	optional	Display name. Defaults to email prefix.

typescript

const { data, error } = await db.auth.signIn({
  email: 'user@example.com',
  password: 'password123',
});

if (error) {
  // Invalid credentials, rate limited, etc.
  console.error(error.message);
  return;
}

const { user, session } = data;
console.log('Signed in as:', user.email);
console.log('Token:', session.access_token);

Get Current User

typescript

const { data: { user } } = await db.auth.getUser();

if (!user) {
  // Not authenticated
  redirect('/login');
}

Sign Out

typescript

await db.auth.signOut();
// Token cleared from memory and localStorage

Session Persistence

typescript

// Token is automatically persisted to localStorage['zendbx_token']
// On next page load, it's restored automatically

// To opt out of localStorage (SSR / Node.js):
const db = createClient({
  apiUrl, anonKey, projectSlug,
  storageKey: null,  // disables storage
  getAccessToken: () => mySessionStore.getToken(),
});

Password Reset

typescript

// Step 1: Request reset email
await db.auth.resetPassword('user@example.com');

// Step 2: After user clicks email link, update password
await db.auth.updatePassword(token, 'newpassword123');

JWT Structure

ZendBX JWTs are standard HS256 tokens. Here's what the payload looks like:

json

{
  "sub": "user-uuid",
  "email": "user@example.com",
  "role": "authenticated",
  "iss": "zendbx",
  "project_id": "project-uuid",
  "iat": 1718000000,
  "exp": 1718604800
}

⚠️JWTs expire after 7 days. Call db.auth.getSession() to verify the token is still valid. If it returns null, redirect to login.

OAuth Providers

OAuth is configured per-project in the Dashboard → Authentication → Providers. Supported providers: Google, GitHub.

bashGet OAuth redirect URL

# Get OAuth login URL
curl https://api.zendbx.in/oauth/{provider}/login?project_slug=my-project

REST API Examples

bashSign up

curl -X POST https://api.zendbx.in/v1/auth/{project-id}/signup \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","password":"password123","name":"Jane"}'

bashSign in

curl -X POST https://api.zendbx.in/v1/auth/{project-id}/login \
  -H "Content-Type: application/json" \
  -d '{"email":"user@example.com","password":"password123"}'

Authentication

How It Works

Sign Up

Sign In

Get Current User

Sign Out

Session Persistence

Password Reset

JWT Structure

OAuth Providers

REST API Examples

Authentication

How It Works

Sign Up

Sign In

Get Current User

Sign Out

Session Persistence

Password Reset

JWT Structure

OAuth Providers

REST API Examples