SDK Reference
ReferenceGenerated from the SDKs' TypeScript types. For the HTTP endpoints, see the API reference.
@rekey.dev/node
pnpm add @rekey.dev/nodeServer SDK. One client per Application, constructed with the secret key. Auth, billing, organizations, licenses, usage, and credits live as namespaces on the client.
RekeyTop-level Rekey client. Auth and billing live as namespaces (`rekey.applications`, `rekey.auth`, `rekey.billing`) so an agent reading `rekey.` in an editor sees a discoverable surface.
new Rekey(config: RekeyConfig)with(options: RekeyCallOptions): RekeyA clone of this client with different call options — the per-call knob for every wrapped method.
request(method: string, path: string, options?: RekeyRequestOptions): Promise<T>Call a Rekey endpoint this SDK does not wrap yet.
rekey.applicationsApplicationsClientme(): Promise<ApplicationDto>Verify credentials and fetch the calling Application. Use this as your SDK smoke test — if it returns, your secret key is good and you're pointed at the right Rekey deployment.
rekey.authAuthClientsignUp(input: SignUpRequest): Promise<AuthResultDto>Create a new end-user in the calling Application via email + password. Returns the user plus an `accessToken` for subsequent per-user calls (e.g. `getCurrentUser(accessToken)`) and a `refreshToken` to renew it.
signIn(input: SignInRequest): Promise<SignInOutcomeDto>Authenticate an existing end-user with email + password.
mfaVerify(input: MfaVerifyRequest): Promise<AuthResultDto>Exchange an MFA challenge token + TOTP/backup code for a real session. Use after `signIn` (or OAuth callback) returns `mfaRequired: true`.
requestMagicLink(input: { email: string; signInUrl?: string; }): Promise<{ delivered: boolean; emailSent: boolean; magicLinkToken: string | null; }>Request a magic-link sign-in email. Enumeration-safe: same response shape whether the email exists or not. When the Application has email transport configured, the link is sent and `magicLinkToken` is null; otherwise the raw token is returned for you to forward.
verifyMagicLink(input: { token: string }): Promise<SignInOutcomeDto>Consume a magic-link token. Returns `SignInOutcome` — branch on `mfaRequired` before reading `accessToken`. For MFA-enrolled users the response carries `mfaChallengeToken` and you must complete via `mfaVerify(...)`.
startPasskeyAuthentication(input?: { email?: string }): Promise<{ options: unknown; expectedChallenge: string; }>Begin a passkey authentication ceremony. Returns the WebAuthn options to forward to the browser (`navigator.credentials.get(...)`) along with `expectedChallenge` — bind the challenge to your session and pass both back via `verifyPasskeyAuthentication(...)`.
verifyPasskeyAuthentication(input: { response: unknown; expectedChallenge: string; }): Promise<SignInOutcomeDto>Complete a passkey authentication. Returns the same `SignInOutcome` shape as `signIn` — but passkeys are themselves a strong factor, so `mfaRequired` will always be `false` in practice.
startPasskeyRegistration(accessToken: string): Promise<{ options: unknown; expectedChallenge: string; }>Begin a passkey registration ceremony for an authenticated user. Forward `options` to `navigator.credentials.create(...)`; store `expectedChallenge` in session; POST both back via `verifyPasskeyRegistration(...)`.
verifyPasskeyRegistration(accessToken: string, input: { response: unknown; expectedChallenge: string; deviceName?: string; }): Promise<{ credentialId: string; deviceName: string | null }>listPasskeys(accessToken: string, page?: ListPage): Promise< Paged<{ id: string; credentialId: string; deviceName: string | null; lastUsedAt: string | null; createdAt: string; }> >List the user's registered passkeys, newest first.
deletePasskey(accessToken: string, credentialRowId: string): Promise<{ deleted: boolean }>Remove a passkey. Returns `{deleted: false}` if the row doesn't belong to this user.
getCurrentUser(accessToken: string): Promise<EndUserDto & { activeOrganizationId: string | null }>Resolve the end-user behind a presented access token.
updateCurrentUser(accessToken: string, input: { metadata?: Record<string, unknown> | null }): Promise<EndUserDto & { activeOrganizationId: string | null }>Update the end-user behind a presented access token — their OWN record, and only ever their own: the token identifies the subject, so there is no user id to pass and no way to aim this at anyone else.
refresh(refreshToken: string): Promise<AuthResultDto>Exchange a refresh token for a fresh {access, refresh} pair. The presented refresh is revoked atomically — call this **once** and store the new `refreshToken` from the response immediately.
signOut(refreshToken: string): Promise<{ signedOut: true }>Revoke a refresh token. Idempotent — no-op for unknown tokens. The access token paired with this refresh remains valid until its short (15 min) expiry; for true "log out everywhere" semantics, also clear the access token from your client.
requestPasswordReset(input: ForgotPasswordRequest): Promise<ForgotPasswordResultDto>Request a password reset for an email. Always succeeds — never tells you whether the email exists.
resetPassword(input: ResetPasswordRequest): Promise<{ ok: true }>Consume a reset token + set a new password. Single-use. On success, every refresh token for the user is revoked.
changePassword(accessToken: string, input: ChangePasswordRequest): Promise<{ ok: true }>Authenticated password change. Pass the user's *current* access token. On success, every refresh token for the user is revoked — other devices are signed out.
signOutEverywhere(accessToken: string): Promise<{ revokedCount: number }>Revoke every refresh token for the calling user. "Sign out of all devices." The caller's access token remains valid until 15-min expiry — clear it client-side for full logout.
sendVerificationEmail(accessToken: string, input?: { verifyUrl?: string }): Promise<{ emailSent: boolean; verificationToken: string | null }>Send (or re-send) an email-verification link to the current user. If email transport is configured on the Application, Rekey sends the email and `verificationToken` is null. Otherwise the raw token is returned for the caller to forward via their own provider.
resendVerificationEmail(input: { email: string; verifyUrl?: string; }): Promise<{ emailSent: boolean; verificationToken: string | null }>Re-send a verification link to an address, with **no session** — the sessionless sibling of `sendVerificationEmail`.
verifyEmail(input: { token: string }): Promise<{ verified: true; endUser: EndUserDto }>Consume an email-verification token. Single-use, 24-hour lifetime. Marks `emailVerified: true` on the user record. Cross-Application tokens are refused with `EMAIL_VERIFICATION_TOKEN_WRONG_APPLICATION`.
listSessions(accessToken: string, page?: ListPage): Promise< Paged<{ id: string; createdAt: string; expiresAt: string; userAgent: string | null; ip: string | null; }> >List the current user's active sessions (live refresh tokens), newest first. Each carries the User-Agent + IP captured at issue time and an `id` you can pass to `revokeSession(...)`.
revokeSession(accessToken: string, sessionId: string): Promise<{ revoked: boolean }>Revoke one session by id. Idempotent — `{ revoked: false }` if it isn't this user's.
mfaStatus(accessToken: string): Promise<{ enabled: boolean; remainingBackupCodes: number | null; policy: 'off' | 'optional' | 'required'; }>MFA enrollment status for the current user, plus the Application's policy.
mfaSetup(accessToken: string): Promise<{ otpauthUrl: string; backupCodes: string[]; warning: string; }>Begin TOTP enrollment: mints a secret (as an `otpauthUrl` for the QR) and 10 single-show backup codes. **Not enrolled until `confirmMfaSetup(...)`.** Only SHA-256 hashes of the backup codes are stored — show them once.
confirmMfaSetup(accessToken: string, code: string): Promise<{ ok: true }>Confirm enrollment by submitting the current 6-digit TOTP code.
mfaChallenge(accessToken: string, code: string): Promise<{ ok: boolean }>Verify a TOTP or backup code as a step-up check (does NOT issue a session). Backup codes are single-use — consumed on success. Returns `{ ok }`.
disableMfa(accessToken: string): Promise<{ disabled: true }>Disable MFA for the current user.
startOAuth(provider: string, state: string): Promise<{ authorizationUrl: string }>Get the provider authorization URL to redirect the browser to. Pass an unguessable `state` and verify it on return before calling `completeOAuth`.
completeOAuth(provider: string, code: string): Promise<SignInOutcomeDto>Exchange the provider `code` for a Rekey session. Returns a `SignInOutcome` — branch on `mfaRequired` before reading `accessToken`. Verify the `state` CSRF value yourself before calling.
listOAuthIdentities(accessToken: string): Promise< Array<{ provider: string; providerAccountId: string; email: string | null; createdAt: string; }> >List the OAuth providers linked to the current user.
startOAuthLink(accessToken: string, provider: string, state: string): Promise<{ authorizationUrl: string }>Begin linking a provider to the *currently authenticated* user.
completeOAuthLink(accessToken: string, provider: string, code: string): Promise<{ provider: string; providerAccountId: string; alreadyLinked: boolean }>Complete an OAuth link — attaches the provider identity to the current user. Refuses on unverified provider emails (account-takeover guard) or when the provider account already belongs to a different user.
unlinkOAuth(accessToken: string, provider: string): Promise<{ unlinked: boolean }>Remove a linked provider. Refuses with `OAUTH_UNLINK_WOULD_LOCK_OUT` (409) if it would leave the account with no way to sign in.
rekey.billingBillingClientgetPlans(page?: ListPage): Promise<Paged<PlanDto>>List the calling Application's active plans. Public — pricing pages typically render straight from this. Application API key only; no user JWT needed.
getSubscription(accessToken: string, opts?: { organizationId?: string; includeEnded?: boolean }): Promise<SubscriptionDto | null>Fetch the current end-user's active subscription, or `null` if they have none. Returns the most recent ACTIVE / PENDING / PAST_DUE row.
createCheckout(accessToken: string, input: CreateCheckoutRequest & { couponCode?: string }): Promise<CheckoutResultDto>Start a hosted-checkout session. Returns the URL to redirect the user to and the local PENDING Subscription row. Subscription activation happens via the provider's webhook — not synchronously here.
validateCoupon(accessToken: string, input: ValidateCouponRequest): Promise<ValidateCouponResultDto>Validate a coupon for the current user against a plan, *without* applying it. Render "$50 off" on a pricing page before submit.
getProviders(country?: string): Promise<ProvidersListDto>List the billing providers configured + enabled for this Application, in the order the geo router would prefer them. Forward the end-user's `country` (ISO 3166-1 alpha-2) when you have it — the panel/SDK will surface India-specific providers (Razorpay) for IN-country users, etc.
getEntitlements(accessToken: string, opts?: { organizationId?: string }): Promise<EntitlementsDto>Resolve the calling end-user's current entitlements — feature flags + limits, the live credit balance, and the raw entitlement list, unioned across their active subscriptions (and subscriptions of orgs they belong to). Pass `{ organizationId }` (member-only) for that org's view + shared pool. Gate your app's features on `features`.
cancelSubscription(accessToken: string, input?: { atPeriodEnd?: boolean; organizationId?: string }): Promise<SubscriptionDto>Cancel the calling end-user's current subscription.
rekey.creditsCreditsClientPrepaid credits — the "lead pack" / pay-as-you-go drawdown model. The customer's backend grants credits (by selling a CREDIT-kind plan, which grants automatically on payment) and draws them down per unit consumed.
getBalance(subject: CreditSubject): Promise<CreditBalanceDto>Current spendable balance for a subject (end-user or org); 0 if none.
consume(input: ConsumeCreditsRequest & CreditSubject): Promise<ConsumeCreditsResultDto>Deduct credits from a subject (end-user or org pool). Throws `RekeyError` `code: "CREDITS_INSUFFICIENT"` (HTTP 402) when the balance is too low.
listLedger(subject: CreditSubject, limit?: number, offset?: number): Promise<Paged<CreditLedgerEntryDto>>Ledger entries for a subject, newest first. Pass `offset` to page back through the full append-only history (the ledger grows for the life of a subject); `limit` is capped at 200 server-side.
rekey.licensesLicensesClientverify(input: { key: string; machineFingerprint: string; label?: string; }): Promise<LicenseVerifyResultDto>Verify a license key + record an activation for this machine. Call once at app startup; you'll get a deterministic body (`ok=false` for invalid licenses — never an HTTP error — so your software can loop on the result without try/catch noise).
rekey.mcpMcpClientMCP helpers for customers running their OWN MCP server behind Rekey auth. The hosted MCP server (account tools) is consumed by MCP clients directly — this client is for the "bring your own MCP server" path: validate incoming Rekey-issued tokens, and read the OAuth metadata.
introspect(token: string): Promise<OAuthIntrospectionResponse>Validate an MCP access token (RFC 7662 introspection). Call this from your own MCP server to authorize an incoming request. Authenticated with this client's secret key.
metadata(): Promise<OAuthAuthServerMetadata>Fetch this application's OAuth authorization-server metadata (RFC 8414).
rekey.organizationsOrganizationsClientcreate(accessToken: string, input: { name: string; slug: string; metadata?: Record<string, unknown> }): Promise<{ organization: OrganizationDto; membership: { id: string; role: 'OWNER'; baseRole: 'OWNER' }; }>Create an organization; the calling user becomes the OWNER.
listRoles(accessToken: string): Promise<OrganizationRoleDefDto[]>List the organization roles assignable in this Application.
listMine(accessToken: string, page?: ListPage): Promise<Paged<OrganizationWithRoleDto>>List organizations the calling user belongs to, with their role.
get(accessToken: string, organizationId: string): Promise<OrganizationWithRoleDto>Fetch one organization the caller belongs to.
update(accessToken: string, organizationId: string, input: { name?: string; metadata?: Record<string, unknown> }): Promise<OrganizationDto>Update org name / metadata. OWNER + ADMIN only.
listMembers(accessToken: string, organizationId: string, page?: ListPage): Promise<Paged<OrganizationMemberDto>>List members of an organization the caller belongs to.
invite(accessToken: string, organizationId: string, input: { email: string; role?: OrganizationRole }): Promise<{ invitation: OrganizationInvitationDto; token: string }>Invite a user. Returns the raw token ONCE — surface via your own email/share channel. OWNER + ADMIN only.
revokeInvitation(accessToken: string, organizationId: string, invitationId: string): Promise<{ revoked: boolean }>Revoke a pending invitation. OWNER + ADMIN only. Idempotent.
setMemberRole(accessToken: string, organizationId: string, targetEndUserId: string, input: { role: OrganizationRole }): Promise<{ id: string; organizationId: string; endUserId: string; role: OrganizationRole; /** The tier the name maps to. Gate your own features on this. */ baseRole: OrganizationBaseRole; }>Change a member's role. OWNER manages anyone; ADMIN manages MEMBER only. Last-OWNER guard refuses demoting the only OWNER.
removeMember(accessToken: string, organizationId: string, targetEndUserId: string): Promise<{ removed: boolean }>Remove a member (or self). Refuses removing the last OWNER.
leave(accessToken: string, organizationId: string): Promise<{ removed: boolean }>Self-leave. An OWNER cannot leave (payment + benefits are tied to the owner — `ORGANIZATION_OWNER_CANNOT_LEAVE`); transfer ownership via support first, or demote yourself to ADMIN if there is another OWNER.
acceptInvitation(accessToken: string, input: { token: string }): Promise<{ membership: { id: string; organizationId: string; role: 'OWNER' | 'ADMIN' | 'MEMBER'; }; }>Accept an organization invitation by raw token. Refuses cross- Application invitations. Idempotent if the caller is already a member.
switch(accessToken: string, organizationId: string): Promise<AuthResultDto>Make `organizationId` the active org for this session (member-only). Returns a fresh {accessToken, refreshToken} pair carrying the active org — **store both**. Subsequent entitlement reads (`billing.getEntitlements`) then default to this org's view + shared pool without passing `organizationId` explicitly. The active org survives token refresh until you switch again, clear it, or leave the org.
clearActive(accessToken: string): Promise<AuthResultDto>Clear the active org — switch the session back to the personal pool. Returns a fresh token pair (no active org); **store both**.
rekey.usageUsageClientrecord(input: { meterSlug: string; quantity: number; /** Attribute to an end-user, or an `organizationId` (shared org pool), or * neither (app-level usage). Pass at most one subject. */ endUserId?: string; organizationId?: string; occurredAt?: string; metadata?: Record<string, unknown>; }): Promise<UsageRecordDto>Record a usage event against a named meter. `quantity` can be negative to credit back (e.g. refunds). `occurredAt` defaults to server time; pass an ISO string when ingesting historical events.
aggregate(input: { meterSlug: string; from?: string; to?: string; endUserId?: string; organizationId?: string; }): Promise<UsageAggregateDto>Sum recorded quantity for a meter, optionally bounded by a time window and/or scoped to a subject (`endUserId` or `organizationId`). Drives "you've used X of your Y quota" displays.
verifyAccessTokenVerify an end-user ACCESS token **offline** — no round-trip to the Rekey API. Works only for Applications that opted into RS256 tokens (`authConfig.tokenAlg = "RS256"`, Panel → Application → Auth); the default HS256 tokens are symmetric and can only be verified by the API itself (use `rekey.auth.getCurrentUser(token)` for those).
verifyAccessToken(token: string, options: VerifyAccessTokenOptions): Promise<VerifiedAccessTokenClaims>verifyWebhookSignatureVerify the HMAC signature on an inbound webhook from Rekey. Returns `true` only when (a) the timestamp is fresh (within `toleranceSeconds`, default 300) AND (b) the signature matches a constant-time compare.
verifyWebhookSignature(args: { header: string | null | undefined; payload: string | Buffer; secret: string; toleranceSeconds?: number; now?: () => number; }): boolean@rekey.dev/react
pnpm add @rekey.dev/reactBrowser SDK + React hooks/components. Holds only the user access token — never the secret key.
RekeyBrowserClientnew RekeyBrowserClient(config: RekeyBrowserConfig)getCurrentUser(accessToken: string, meEndpoint = '/api/v1/auth/me'): Promise<EndUserDto | null>Fetch the current end-user given an access token. Returns null on USER_TOKEN_INVALID so callers can render signed-out state without try/catch noise.
signUp(input: SignUpRequest): Promise<AuthResultDto>Create a new end-user (email + password). Returns the user + session tokens.
signIn(input: SignInRequest): Promise<SignInOutcomeDto>Authenticate (email + password). Returns a `SignInOutcome` — branch on `mfaRequired` before reading `accessToken`; MFA-enrolled users get an `mfaChallengeToken`, complete via `mfaVerify(...)`.
mfaVerify(input: MfaVerifyRequest): Promise<AuthResultDto>Exchange an MFA challenge token + code for a real session.
requestMagicLink(input: { email: string; signInUrl?: string }): Promise<{ delivered: boolean; emailSent: boolean; magicLinkToken: string | null; }>Request a magic-link sign-in email. Enumeration-safe.
verifyMagicLink(input: { token: string }): Promise<SignInOutcomeDto>Consume a magic-link token. Returns a `SignInOutcome` (branch on `mfaRequired`).
refresh(refreshToken: string): Promise<AuthResultDto>Exchange a refresh token for a fresh access/refresh pair.
signOut(refreshToken: string): Promise<{ signedOut: true }>Revoke a refresh token (sign out). Idempotent.
startPasskeyAuthentication(input?: { email?: string }): Promise<{ options: unknown; expectedChallenge: string; }>Begin a passkey authentication ceremony — forward `options` to `navigator.credentials.get`.
verifyPasskeyAuthentication(input: { response: unknown; expectedChallenge: string; }): Promise<SignInOutcomeDto>Complete a passkey authentication. Returns a `SignInOutcome`.
getPlans(page?: ListPage): Promise<Paged<PlanDto>>List the Application's active plans (public catalogue — for pricing pages).
listBillingProviders(opts?: { country?: string }): Promise<ProvidersListDto>The billing providers enabled for this Application, in the order the geo router prefers them (the first is the default pick). Powers a "Pay with…" picker at checkout — feed the result straight into `<ProviderPicker>`.
verifyLicense(input: { key: string; machineFingerprint: string; label?: string; }): Promise<LicenseVerifyResultDto>Verify a license key for this machine. The license `key` is the entitlement bearer; the publishable key only identifies the Application. `ok=false` is a normal result for an invalid/expired license, not an exception.
getSubscription(accessToken: string, opts?: { organizationId?: string; includeEnded?: boolean }): Promise<SubscriptionDto | null>The current subscription — the user's own by default, or an organization's when `opts.organizationId` is passed (org-billed apps; caller must be a member). Returns null when there's no active/pending/past-due subscription.
listOrganizations(accessToken: string, page?: ListPage): Promise<Paged<OrganizationWithRoleDto>>Organizations the signed-in user belongs to, each with their role.
getEntitlements(accessToken: string, opts?: { organizationId?: string }): Promise<EntitlementsDto>The signed-in user's entitlements (features, limits, credit balance).
listPayments(accessToken: string, limit?: number, offset?: number): Promise<Paged<PortalPaymentDto>>The signed-in user's own payment history, newest first.
cancelSubscription(accessToken: string, opts?: { atPeriodEnd?: boolean; organizationId?: string }): Promise<SubscriptionDto>Cancel the current subscription (default: at period end). Pass `opts.organizationId` to cancel an org's subscription (caller must be OWNER/ADMIN of that org).
createCheckout(accessToken: string, input: CreateCheckoutRequest & { couponCode?: string }): Promise<CheckoutResultDto>Start a hosted-checkout session for the signed-in user. Returns the redirect URL.
CheckoutButtonA single checkout button for one plan (Clerk's `<CheckoutButton>`). Posts the plan slug to your checkout Server Action, which redirects to the hosted checkout. Append the active org id via `hiddenFields` for org-scoped billing.
CheckoutButton(props: CheckoutButtonProps): React.JSX.ElementCreateOrganizationStandalone "create a team" card (Clerk's `<CreateOrganization>`). Delegates to your create Server Action.
CreateOrganization(props: CreateOrganizationProps): React.JSX.ElementLoadingLoading({ children }: { children: React.ReactNode }): React.JSX.Element | nullmcpConnectionInfomcpConnectionInfo(args: { apiUrl: string; appSlug: string }): McpConnectionInfoOrganizationProfileManage a team's members + invitations (Clerk's `<OrganizationProfile>`). Reads members/invitations as props (server-resolved) and delegates every mutation to your Server Actions. Manage affordances render only for OWNER/ADMIN viewers.
OrganizationProfile(props: OrganizationProfileProps): React.JSX.ElementOrganizationSwitcherPick / switch / create the active organization (Clerk's `<OrganizationSwitcher>`). Reads the org list as a prop (server-resolved) and delegates switching + creation to your Server Actions. Respects `billingSubject='org'` by nudging the user to select a team when none is active.
OrganizationSwitcher(props: OrganizationSwitcherProps): React.JSX.ElementPricingTableRender the Application's plans as a pricing grid with upgrade buttons (Clerk's `<PricingTable>`). Plans come in as a prop (server-fetched); each upgrade posts to your checkout Server Action. Org-scoped when `hiddenFields` carries the active org id, and gated when `orgGateBlocking`.
PricingTable(props: PricingTableProps): React.JSX.ElementProtectGate UI by entitlement / feature / role. Renders `children` only when the user is signed in AND every supplied check passes; otherwise renders `fallback` (or nothing).
Protect({ authorization, feature, role, condition, children, fallback = null, }: ProtectProps): React.JSX.Element | nullProviderPickerA themed "Pay with…" radio-card group — one option per enabled billing provider. The selected value posts as `provider` in the surrounding form's FormData (uncontrolled, zero-JS) or drives a controlled `value`/`onChange` pair. Friendly names (Stripe / PayPal / Razorpay), a labelled radiogroup, and keyboard navigation come built in.
ProviderPicker(props: ProviderPickerProps): React.JSX.ElementRekeyLoadedRenders children once the provider has resolved the session (the `<ClerkLoaded>` equivalent).
RekeyLoaded({ children }: { children: React.ReactNode }): React.JSX.Element | nullRekeyLoadingRenders children only while the provider is resolving the session — the `<ClerkLoading>` equivalent. Pair with `<RekeyLoaded>`.
RekeyLoading({ children }: { children: React.ReactNode }): React.JSX.Element | nullRekeyProviderRekeyProvider({ children, apiUrl, publishableKey, initialUser = null, accessToken = null, meEndpoint, }: RekeyProviderProps): React.JSX.ElementRekeyStylesRender the component stylesheet once, yourself.
RekeyStyles({ children }: { children?: React.ReactNode }): React.JSX.ElementSignedInSignedIn({ children }: { children: React.ReactNode }): React.JSX.Element | nullSignedOutSignedOut({ children }: { children: React.ReactNode }): React.JSX.Element | nullSignInDrop-in sign-in card: email + password, optional magic-link, optional OAuth. Delegates the actual sign-in to your server (`action` / `actionUrl`).
SignIn(props: SignInProps): React.JSX.ElementSignInButtonA button that navigates to your sign-in page.
SignInButton(props: NavButtonProps): React.JSX.ElementSignOutButtonA button (form) that invokes your sign-out Server Action.
SignOutButton(props: NavButtonProps): React.JSX.ElementSignUpDrop-in sign-up card. Like `<SignIn>` but posts to your sign-up action.
SignUp(props: SignUpProps): React.JSX.ElementSignUpButtonA button that navigates to your sign-up page.
SignUpButton(props: NavButtonProps): React.JSX.ElementThemedEstablishes the themed scope. Every public component wraps its tree in this: it injects the stylesheet, sets `.rekey-root` + the theme attribute, and applies variable overrides inline. `className` is forwarded to the root so an integrator can target the whole widget; `appearance.elements.root` is merged in too.
Themed({ appearance, className, style, children, }: { // `| undefined` is explicit so callers can spread possibly-undefined props // under `exactOptionalPropertyTypes`. appearance?: AppearanceProp | undefined; className?: string | undefined; style?: React.CSSProperties | undefined; children: React.ReactNode; }): React.JSX.ElementuseAppearanceRead the active appearance — used by `cx` to merge element overrides.
useAppearance(): AppearanceUserButtonAvatar + dropdown menu for the signed-in user (Clerk's `<UserButton>`). Renders nothing when signed out. The avatar shows the user's email initial.
UserButton(props: UserButtonProps): React.JSX.Element | nulluseRekeyManual session refresh. Usually called after a sign-in / sign-out round-trip the customer's server handles, so the provider re-fetches the latest user state.
useRekey(): { refresh: () => Promise<void>; }useUserThe current end-user, or `null` if signed out. Check `user` for null first, then TypeScript narrows the type.
useUser(): { user: EndUserDto | null; signedIn: boolean; loading: boolean; }@rekey.dev/nextjs
pnpm add @rekey.dev/nextjsNext.js App Router adapters — middleware + server helpers built on @rekey.dev/node.
authResolve the current session from cookies. Tries the access token first; on `USER_TOKEN_INVALID` refreshes once. Returns null when signed out.
auth(): Promise<Session | null>createSessionFinalize a **browser** login into httpOnly session cookies.
createSession(tokens: { accessToken: string; refreshToken: string; }): Promise<void>mcpConnectionInfoBuild the MCP connection URL + `claude mcp add` command for an MCP-enabled Application (Panel → Application → MCP). Render a "Connect to Claude" button with this. Pure string-building — the MCP client runs the OAuth flow itself.
mcpConnectionInfo(args: { apiUrl: string; appSlug: string }): McpConnectionInfomfaVerifyServer action: complete an MFA-required sign-in. Sets cookies on success. Throws `RekeyError` with code `MFA_CODE_INVALID` / `MFA_CHALLENGE_INVALID` on failure — surface the error message to the user and prompt to retry.
mfaVerify(input: { mfaChallengeToken: string; code: string; }): Promise<Session>rekeyMiddlewarerekeyMiddleware(config: MiddlewareConfig = {})signInServer action: sign in with email + password.
signIn(input: { email: string; password: string; }): Promise<SignInOutcome>signOutServer action: revoke the refresh token + clear cookies. Optionally pass `redirectTo` to bounce afterwards.
signOut(redirectTo?: string): Promise<void>signUpServer action: sign up + create the user + start a session.
signUp(input: { email: string; password: string; metadata?: Record<string, unknown>; }): Promise<Session>