From raw fetch to the client

The palmshed.github.io sign-in pages are the reference migration: they moved from hand-written fetch() calls plus manual localStorage handling to @palmshed/auth-client. The client owns token storage, the Authorization header, and token refresh.

Replace:

// before
const token = localStorage.getItem("session");
const res = await fetch(API + "/api/v1/me", {
  headers: { authorization: "Bearer " + token },
});

with:

// after
const client = new AuthClient({ baseUrl: API });
const res = await client.getSession();

See UPGRADING.md for the full method-by-method table and rollback guidance.

From another auth provider

  1. Export existing users with an Argon2id-compatible password hash and a per-user salt, or force a password reset on first sign-in.
  2. Migrate sessions: old tokens are signed with the previous provider's key and cannot be verified. Ask users to sign in again.
  3. Stand up the storage (Postgres recommended) and run migrate().
  4. Point the client baseUrl at the service and remove the old SDK.

Version compatibility