API reference

The auth surface of @zeitlosapp/sdk, reached as client.auth. It is browser-safe: the session is an httpOnly cookie, so these calls work from client components as well as server code.

createClient

import { createClient } from '@zeitlosapp/sdk';

const client = createClient(); // zero-config in a hosted app

It'll know automatically how to talk to the Zeitlos authentication endpoints. Only in local development if you changed the ports.auth variable in your zeitlos.dev.json, you'll need to tell the client how to reach the auth endpoints. See local development for more details.

createClientForUser

Binds a server request's session to the client, so every auth call carries it:

import { cookies } from 'next/headers';
import { createClientForUser } from '@zeitlosapp/sdk';

const client = createClientForUser({ cookies: await cookies() });
const user = await client.auth.getUser();

Accepts one of { cookies } (a Next cookie store or a raw cookie string), { request } (a Request, NextRequest or Node IncomingMessage), or { headers } (a Headers or a Node headers record).

Methods

await client.auth.signUp({ email, password, name });
await client.auth.signIn({ email, password });
await client.auth.signOut();

const user = await client.auth.getUser();
const me = await client.auth.getUser({ profile: true });
await client.auth.updateProfile({ bio: 'Hello' });

await client.auth.sendVerificationEmail({ email });
await client.auth.forgetPassword({ email });
await client.auth.resetPassword({ token, newPassword });

getUser is the one call that does not throw when there is no session — it returns null.

Optional inputs

Types

interface AuthUser {
  id: string;
  email: string;
  emailVerified: boolean;
  name?: string;
  image?: string | null;
  createdAt?: string;
}

interface AuthUserWithProfile<P> extends AuthUser {
  profile: MaskedProfile<P>;
}

type ProfileValues = Record<string, string | string[] | null>;

MaskedProfile<P> makes every field of P optional and nullable — absent when not visible to the caller, null when visible but unset. See Profile fields.

Errors

Auth calls throw ZeitlosError with a machine-readable .code:

import { ZeitlosError } from '@zeitlosapp/sdk';

try {
  await client.auth.signIn({ email, password });
} catch (err) {
  if (err instanceof ZeitlosError && err.code === 'EMAIL_NOT_VERIFIED') {
    await client.auth.sendVerificationEmail({ email });
  }
}

The list isn't exhaustive — treat unknown codes generically.

Not in the SDK

This is the end-user surface: your own session and your own profile. Administrative operations — listing users, editing someone else's profile, defining profile fields — happen in the dashboard or through the MCP server.