User Session

Read the current user

getUser() returns the current user, or null if there is no session. It reads from memory and does not make a request.

const user = Auther.getUser();

if (user) {
  console.log(user.id);               // UUID
  console.log(user.email);            // 'jane@example.com'
  console.log(user.name);             // 'Jane Doe' - or null if never given
  console.log(user.expiresAt);        // epoch ms - access token expiry
  console.log(user.refreshExpiresAt); // epoch ms - refresh token expiry
}

Restoring the session on page load

Nothing is persisted in the browser, so on a fresh page load the SDK asks the server who you are, using the HTTP-only refresh cookie. That is a network round trip, so for a brief moment after init() the user is not known yet and getUser() returns null. Do not decide whether someone is logged out from a single synchronous read at startup. Subscribe instead, and your callback fires once the session resolves.

Auther.init({ clientId: 'req_live_...' });

// Fires immediately with the current value, then again once the
// session has been restored (or confirmed absent).
Auther.onAuthStateChange((user) => {
  if (user) showApp(user);
  else      showLoginButton();
});

In React this is handled for you: useAuther() exposes a ready flag that stays false until the session has resolved, so you can render a loader and avoid a logged-out flash.

Get a token for your own API

The SDK does not wrap your requests. Ask it for a token and attach it yourself.getFreshToken() refreshes first if the token is close to expiry, so it always hands back a usable token (or null if there is no session).

const token = await Auther.getFreshToken();

await fetch('https://api.yourapp.com/me', {
  headers: token ? { Authorization: `Bearer ${token}` } : {},
});

Automatic token rotation

Access tokens are short-lived (15 minutes). The SDK refreshes them in the background 60 seconds before expiry, and again when a backgrounded tab becomes visible. Concurrent refreshes are de-duplicated into a single request. Sessions stay alive for up to 30 days.