Authentication
Sign a customer in, register a new one, and hold the access token.
A successful sign-in writes the access token to the subbly_access_token
cookie, sets the Authorization header on the shared HTTP client, and flips
subbly.auth.isAuthenticated to true. The cookie lasts 365 days and is set on
path=/. It is a plain cookie: the SDK sets no Secure, HttpOnly or
SameSite attribute, so treat it as readable by any script on the host.
A boolean property, not a method. It is true after a successful
checkAuthenticated, login, register, otpLogin or social, and false
after logout. Nothing watches it, so read it after an authentication call
rather than expecting it to update on its own.
Returnsboolean
true when the SDK holds a token it has checked.
Branch on the authentication state
Verifies that the SDK can call the methods that need a signed-in customer.
Subbly.init calls it for you at start-up.
The check costs one request: it calls subbly.customers.me() behind the scenes.
When it passes, the SDK sets the Authorization header and, if you passed a
token, writes it to the cookie. When it fails, the SDK clears the header and the
cookie and logs the error to the console.
Method parameters
tokenoptionalstringAn access token to check. It beats the token in the cookie. Leave it out to check the token already stored.
ReturnsPromise<boolean>
true when the customer is signed in. It resolves with false rather than
rejecting when there is no token or the token is rejected.
Check the stored token
Check a token you hold
Signs the customer in with an email and a password.
Method parameters
payloadRequiredAuthResourceLoginPayloadThe credentials.
ReturnsPromise<AuthResourceLoginResponse>
The new token. The SDK stores it for you.
Log in
Creates an account and signs the new customer in. It stores the token exactly as
login does.
Method parameters
payloadRequiredAuthResourceRegisterPayloadThe new customer.
ReturnsPromise<AuthResourceLoginResponse>
The new token, in the same shape login returns.
Register a customer
Reports whether an email already has a Subbly account. Use it to send the customer to the sign-in form instead of the sign-up form.
Method parameters
payloadRequiredAuthResourceRegisteredPayloadThe email to look up.
emailRequiredstringEmail address to check.
ReturnsPromise<AuthResourceRegisteredResponse>
The answer.
registeredbooleantrue when an account already exists for the email.
Check an email
Emails a one-time password to the address you give. Pass the code the customer
types back to subbly.auth.otpLogin.
Method parameters
payloadRequiredAuthResourceOtpPayloadWhere to send the code.
emailRequiredstringEmail address to send the one-time password to.
ReturnsPromise<void>
Nothing. The response body is empty.
Send a one-time password
Signs the customer in with the one-time password subbly.auth.otp emailed. It
stores the token exactly as login does.
Method parameters
payloadRequiredAuthResourceOtpLoginPayloadThe email and the code.
ReturnsPromise<AuthResourceLoginResponse>
The new token, in the same shape login returns.
Log in with a one-time password
Signs the customer in with a Google or Facebook token. The provider must be
switched on for the shop; look for a google_login or facebook_login entry in
subbly.shop.apps. It stores the token exactly as login does.
Method parameters
payloadRequiredAuthResourceSocialPayloadThe token from the provider.
ReturnsPromise<AuthResourceLoginResponse>
The new token, in the same shape login returns.
Log in with Google
Clears the authentication state in the browser: it sets isAuthenticated to
false, drops the Authorization header, and empties the
subbly_access_token cookie.
It sends no request, so the token itself stays valid until it expires. Do not
rely on logout to lock anything down on the server.
Returnsvoid
Nothing. This method is not a promise.
Log out
Reads the access token out of the subbly_access_token cookie. It is
synchronous and makes no request. Use it to hand the token to your own backend.
Returnsstring | null
The stored token. null when there is no cookie, and an empty string after
subbly.auth.logout(). The TypeScript type says string | undefined; the SDK
never returns undefined.
Read the access token