Email and password

#Sign up

const sovaria = createClient('https://<project-ref>.sovaria.in', '<anon-key>')

const result = await sovaria.auth.signUp('ada@example.com', 'Correct-Horse-9!', 'Ada')
if (result.email_verification_required) {
  showMessage('Check your inbox to confirm your email.')
} // otherwise the user is signed in

• Sign-ups must be allowed for the project (Sign in / Providers → Allow new users to sign up); otherwise the API answers 403.
• Default password rules: at least 8 characters with an uppercase letter, a digit and a symbol. Change them under Security & JWT. A weak password returns 422 with the rule it broke.
• signUp creates the user and signs them in. register only creates the user.

#Confirm the email address

When email verification is on, the user receives a confirmation email. The link opens your Site URL with ?token=…&type=signup. Call handleEmailLink() on that page:

const result = await sovaria.auth.handleEmailLink()   // reads window.location
if (result?.type === 'signup') showMessage('Email confirmed — you can sign in now.')

#Sign in

const session = await sovaria.auth.signIn('ada@example.com', 'Correct-Horse-9!')
if (session.mfa_required) {
  // ask for the 6-digit code from their authenticator app
  await sovaria.auth.verifyMfa(code)
}
const me = await sovaria.auth.me()

Wrong credentials return 401 with a generic message. Repeated failures are rate-limited per IP and per email.

#Reset a forgotten password

1. 1

   Request the email

   JavaScript

   await sovaria.auth.resetPasswordForEmail('ada@example.com', { redirectTo: 'https://app.example.com/reset' })

2. 2

   Handle the link

   The link opens redirectTo (or your Site URL) with ?token=…&type=recovery. handleEmailLink() returns the token so you can show a "new password" form.

3. 3

   Set the new password

   JavaScript

   const link = await sovaria.auth.handleEmailLink()
   if (link?.type === 'recovery') {
     await sovaria.auth.confirmPasswordReset(link.token, newPassword)
   }