Authentication

FASTBASE Auth signs your app’s users in. Switch methods on under Authentication; your app uses one SDK call.

Anything sent by email or SMS needs a delivery provider on the FASTBASE installation (Resend, Twilio). Until one is connected, messages are written to the server log instead of being sent, and the dashboard says so.

Email and password

const { user, session } = await fastbase.auth.signUp({ email, password })
await fastbase.auth.signInWithEmail({ email, password })

Passwords are at least 8 characters and are stored as salted scrypt hashes.

Password reset

await fastbase.auth.resetPasswordForEmail({ email })

// On the page the link opens:
const { resetToken } = await fastbase.auth.handleRedirect()
if (resetToken) await fastbase.auth.updatePassword({ token: resetToken, password: newPassword })

A reset ends every existing session of that user.

Magic link

await fastbase.auth.signInWithMagicLink({ email })

// Once, when your app loads:
const { session, error } = await fastbase.auth.handleRedirect()

The link works once, for 30 minutes. A new user is created on first use.

One-time codes

await fastbase.auth.signInWithOtp({ phone: "+905551234567" })
const { user } = await fastbase.auth.verifyOtp({ phone: "+905551234567", code })

Codes have 6 digits, expire after 10 minutes, work once, and are abandoned after 5 wrong attempts.

Google and GitHub

Each project uses its own OAuth app, so users see your app’s name on the consent screen.

1. Create an OAuth app at the provider (Google Cloud Console → Credentials, or GitHub → Developer settings → OAuth Apps).
2. Set its redirect / callback URL to the one shown under Authentication → Google and GitHub sign-in.
3. Paste the client ID and secret there, then switch the method on.

location.href = fastbase.auth.getOAuthUrl("google")   // or "github"

// Once, when your app loads:
const { session, error } = await fastbase.auth.handleRedirect()

Accounts are matched by email address, and only when the provider reports the address as verified.

Redirect addresses

Links and OAuth sign-ins return users to your project’s live address by default. To return elsewhere — a custom domain, or http://localhost:3000 while developing — add the address under Authentication → Redirect addresses and pass redirectTo:

await fastbase.auth.signInWithMagicLink({ email, redirectTo: "http://localhost:3000/welcome" })

An address that is not listed is refused, so a crafted link cannot deliver a session to someone else’s site.

Sessions

session.accessToken is an opaque token valid for 30 days. The SDK sends it for you after sign-in. It lives in memory: persist session yourself and restore it with fastbase.auth.setSession(session).

To protect one of your own server routes:

const fastbase = createFastBase({ url: process.env.FASTBASE_URL!, key: process.env.FASTBASE_SECRET_KEY! })

export async function GET(request: Request) {
  const token = request.headers.get("authorization")?.replace("Bearer ", "")
  fastbase.auth.setSession(token ? { accessToken: token, expiresAt: "" } : null)
  const user = await fastbase.auth.getUser()
  if (!user) return new Response("Unauthorized", { status: 401 })
  // …
}

Create one client per request when you do this, so sessions of different users never mix.

Managing users

The dashboard lists the most recent users with their sign-in method. Admins can delete a user through the API (DELETE /api/v1/projects/:project/auth/users/:id).