Client - palmshed/auth

AuthClient

Framework-agnostic. Works in browsers and Node.js. Tokens are stored in localStorage (configurable via storage and key options) and sent as an Authorization: Bearer header.

Constructor

const client = new AuthClient({
  baseUrl: "https://palmshed-auth.vercel.app",  // required
  storageKey: "session",                          // token storage key
  refreshKey: "session_refresh",                  // refresh token key
  fetch: globalThis.fetch,                        // override the fetcher
  onStateChange: (state) => {},                   // auth state subscription
});

baseUrl is the server origin; the client appends the /api/v1 paths itself.

Methods

All methods return an AuthResponse: { ok: true, data } on success or { ok: false, error } on failure. They never throw for request failures; use the signal option with an AbortController to time out long requests.

Method	Description
`signIn(username, password, opts)`	Sign in and store tokens
`signUp(username, password, email, opts)`	Create an account
`signOut(opts)`	End the session and clear tokens
`getSession(opts)`	Validate the current token, refresh if needed
`refreshToken()`	Exchange the refresh token for a new pair
`forgotPassword(username, opts)`	Request a reset link
`resetPassword(token, password, opts)`	Set a new password
`getConfig(opts)`	Read public captcha and registration config
`getToken()` / `getRefreshToken()`	Read stored tokens
`clearTokens()`	Remove stored tokens
`isAuthenticated()`	True when a token exists
`addInterceptor(fn)`	Rewrite requests before they are sent; returns an unsubscribe function

Options accept captcha (the widget token) and signal (an AbortSignal).

State

client.state is one of:

{ status: "loading" }
{ status: "authenticated"; user; token }
{ status: "unauthenticated" }
{ status: "error"; error }

Pass onStateChange to subscribe. For React, the runnable example in examples/react shows a useAuth hook built on these primitives.