--- title: "nuxt-backend/auth" description: "Every export of nuxt-backend/auth, with its signature and where it is defined." canonical_url: "https://nuxt-backend.dev/docs/reference/api/auth" --- # nuxt-backend/auth ## Classes ### APIError Defined in: node_modules/@better-auth/core/dist/error/index.d.mts:11 The auth layer's request error, re-exported so an app needs no direct dependency on the auth library. Throw it from a hook `setupAuth` passes through (`authOptions.databaseHooks`, `organization.organizationHooks`) to refuse with a status and a message the client shows, not a bare 500: `throw new APIError('BAD_REQUEST', { message: 'Invite a company address.' })`. Add a catalog `code` and its fields to the body (`{ code: 'invalid_input', field: 'email', message }`) and the client reads it with `getBackendError` like the package's own refusals. #### Extends - `APIError` #### Constructors ##### Constructor ```ts new APIError(...args): APIError; ``` Defined in: node_modules/@better-auth/core/dist/error/index.d.mts:18 ###### Parameters
Parameter Type
... args [ status? : | Status | "OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED" , body? : { message? : string ; code? : string ; cause? : unknown ; } & Record < string , any >, headers? : HeadersInit , statusCode? : number ]
###### Returns [`APIError`](#apierror) ###### Overrides ```ts APIError$1.constructor ``` #### Properties
Property Type Overrides Inherited from Defined in
status | Status | "OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED" APIError$1.status - node_modules/@better-auth/core/dist/error/index.d.mts:12
body | { message? : string ; code? : string ; cause? : unknown ; } & Record < string , any > | undefined APIError$1.body - node_modules/@better-auth/core/dist/error/index.d.mts:13
headers HeadersInit APIError$1.headers - node_modules/@better-auth/core/dist/error/index.d.mts:14
statusCode number APIError$1.statusCode - node_modules/@better-auth/core/dist/error/index.d.mts:15
message string APIError$1.message - node_modules/@better-auth/core/dist/error/index.d.mts:16
errorStack string | undefined APIError$1.errorStack - node_modules/@better-auth/core/dist/error/index.d.mts:17
cause? unknown - APIError$1.cause node_modules/typescript/lib/lib.es2022.error.d.ts:24
name string - APIError$1.name node_modules/typescript/lib/lib.es5.d.ts:1074
stack? string - APIError$1.stack node_modules/typescript/lib/lib.es5.d.ts:1076
#### Methods ##### fromStatus() ```ts static fromStatus(status, body?): APIError; ``` Defined in: node_modules/@better-auth/core/dist/error/index.d.mts:19 ###### Parameters
Parameter Type
status | Status | "OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED" | undefined
body? { message? : string ; code? : string ; cause? : unknown ; } & Record < string , any >
###### Returns [`APIError`](#apierror) ##### from() ```ts static from(status, error): APIError; ``` Defined in: node_modules/@better-auth/core/dist/error/index.d.mts:20 ###### Parameters
Parameter Type
status | Status | "OK" | "CREATED" | "ACCEPTED" | "NO_CONTENT" | "MULTIPLE_CHOICES" | "MOVED_PERMANENTLY" | "FOUND" | "SEE_OTHER" | "NOT_MODIFIED" | "TEMPORARY_REDIRECT" | "BAD_REQUEST" | "UNAUTHORIZED" | "PAYMENT_REQUIRED" | "FORBIDDEN" | "NOT_FOUND" | "METHOD_NOT_ALLOWED" | "NOT_ACCEPTABLE" | "PROXY_AUTHENTICATION_REQUIRED" | "REQUEST_TIMEOUT" | "CONFLICT" | "GONE" | "LENGTH_REQUIRED" | "PRECONDITION_FAILED" | "PAYLOAD_TOO_LARGE" | "URI_TOO_LONG" | "UNSUPPORTED_MEDIA_TYPE" | "RANGE_NOT_SATISFIABLE" | "EXPECTATION_FAILED" | "I'M_A_TEAPOT" | "MISDIRECTED_REQUEST" | "UNPROCESSABLE_ENTITY" | "LOCKED" | "FAILED_DEPENDENCY" | "TOO_EARLY" | "UPGRADE_REQUIRED" | "PRECONDITION_REQUIRED" | "TOO_MANY_REQUESTS" | "REQUEST_HEADER_FIELDS_TOO_LARGE" | "UNAVAILABLE_FOR_LEGAL_REASONS" | "INTERNAL_SERVER_ERROR" | "NOT_IMPLEMENTED" | "BAD_GATEWAY" | "SERVICE_UNAVAILABLE" | "GATEWAY_TIMEOUT" | "HTTP_VERSION_NOT_SUPPORTED" | "VARIANT_ALSO_NEGOTIATES" | "INSUFFICIENT_STORAGE" | "LOOP_DETECTED" | "NOT_EXTENDED" | "NETWORK_AUTHENTICATION_REQUIRED" | undefined
error { code : string ; message : string ; }
error.code string
error.message string
###### Returns [`APIError`](#apierror) ## Interfaces ### AuthMutationCtx Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) A DataModel-independent Convex context that can run mutations / queries and schedule work — what the auth email / rate-limit / lifecycle integrations receive. Auth email flows execute inside a mutation/action, so the request ctx is narrowed to one of these. Kept structural (rather than `GenericMutationCtx`) so a context for *any* data model is assignable. #### Properties
Property Type Defined in
runMutation < Mutation >( mutation , ... args ) => Promise < FunctionReturnType < Mutation >> src/convex/client/auth-types.ts
runQuery < Query >( query , ... args ) => Promise < FunctionReturnType < Query >> src/convex/client/auth-types.ts
scheduler Scheduler src/convex/client/auth-types.ts
--- ### AuthRateLimiter Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Guards auth-sensitive flows. Satisfied by `setupRateLimiter(...)` from `nuxt-backend/rate-limit` (which seeds these named limits). #### Methods ##### limit() ```ts limit( ctx, name, options? ): Promise<{ ok: boolean; retryAfter?: number; }>; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) ###### Parameters
Parameter Type
ctx Pick < AuthMutationCtx , "runQuery" | "runMutation" >
name AuthRateLimitName
options? { key? : string ; throws? : boolean ; }
options.key? string
options.throws? boolean
###### Returns `Promise`<{ `ok`: `boolean`; `retryAfter?`: `number`; }> --- ### AuthCreatedUser Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) The newly-created user passed to [AuthIntegrations.onUserCreated](#onusercreated-1). #### Properties
Property Type Defined in
id string src/convex/client/auth-types.ts
email string src/convex/client/auth-types.ts
name string src/convex/client/auth-types.ts
--- ### AuthDeletedUser Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) The user just deleted, passed to [AuthIntegrations.onUserDeleted](#onuserdeleted-1). #### Properties
Property Type Defined in
id string src/convex/client/auth-types.ts
email string src/convex/client/auth-types.ts
name string src/convex/client/auth-types.ts
--- ### CanSignInInput Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) What [CanSignIn](#cansignin) is asked about. #### Properties
Property Type Description Defined in
email string The address, as Better Auth holds it (lower-cased). src/convex/client/auth-types.ts
isNewUser boolean true when no account exists for the address yet. src/convex/client/auth-types.ts
purpose CanSignInPurpose - src/convex/client/auth-types.ts
--- ### AuthIntegrations Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) The cross-component part of [SetupAuthOptions](#setupauthoptions): the `email` instance every auth email goes out through (required), a `rateLimiter` to throttle sending and checking codes and the privileged routes, `canSignIn` to gate who may sign in or sign up, and `onUserCreated` / `onUserDeleted` to run side effects (durable workflows, analytics, erasure) around the account lifecycle. A code or an invitation the deployment cannot deliver — no `EMAIL_API_KEY`, test mode, no `EMAIL_FROM` — is refused on the request, with a message the form shows and the setting to change in the logs (set `NUXT_BACKEND_LOG_OTP=1` to echo codes to the console during local dev instead). #### Extended by - [`SetupAuthOptions`](#setupauthoptions) #### Type Parameters
Type Parameter Default type
DM extends GenericDataModel GenericDataModel
#### Properties
Property Type Description Defined in
email AuthEmail The app's setupEmail instance: the sign-in codes and every other auth email go out through it. src/convex/client/auth-types.ts
rateLimiter? AuthRateLimiter - src/convex/client/auth-types.ts
onUserCreated? OnUserCreated < DM > - src/convex/client/auth-types.ts
canSignIn? CanSignIn < DM > Gate sign-in / sign-up (invite-only, allow-list, closed beta). See CanSignIn . src/convex/client/auth-types.ts
onUserDeleted? OnUserDeleted < DM > Fired after an account is deleted, after any consumer afterDelete . See OnUserDeleted . src/convex/client/auth-types.ts
--- ### McpAuthOptions Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Options for the agent (MCP) OAuth provider — better-auth's `mcp` plugin. Agents obtain access via dynamic client registration + the OAuth authorization-code flow with PKCE, and every authorization goes through the consent page, where the person approves or denies. All of it is mounted under the auth base path and reachable on the app origin through the base module's auth proxy. #### Properties
Property Type Description Defined in
scopes? string Extra OAuth scopes on top of the built-in set, BACKEND_MCP_SCOPES (identity scopes plus the built-in tool scopes, always offered). src/convex/client/auth-types.ts
loginPath? string The app page a person signs in on mid-authorization. Default /login ; keep it equal to backend.pages.login ( nuxt-backend doctor compares the two). src/convex/client/auth-types.ts
consentPath? string The app page a person approves or denies an agent on. Default /oauth/consent ; keep it equal to backend.pages.agentConsent ( nuxt-backend doctor compares the two). src/convex/client/auth-types.ts
--- ### SetupAuthOptions Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Everything `setupAuth` takes: the auth library's own options, the bundled plugins' options, and the cross-component wiring of [AuthIntegrations](#authintegrations). #### Extends - [`AuthIntegrations`](#authintegrations)<`DM`> #### Type Parameters
Type Parameter Default type
DM extends GenericDataModel GenericDataModel
#### Properties
Property Type Description Inherited from Defined in
email AuthEmail The app's setupEmail instance: the sign-in codes and every other auth email go out through it. AuthIntegrations . email src/convex/client/auth-types.ts
rateLimiter? AuthRateLimiter - AuthIntegrations . rateLimiter src/convex/client/auth-types.ts
onUserCreated? OnUserCreated < DM > - AuthIntegrations . onUserCreated src/convex/client/auth-types.ts
canSignIn? CanSignIn < DM > Gate sign-in / sign-up (invite-only, allow-list, closed beta). See CanSignIn . AuthIntegrations . canSignIn src/convex/client/auth-types.ts
onUserDeleted? OnUserDeleted < DM > Fired after an account is deleted, after any consumer afterDelete . See OnUserDeleted . AuthIntegrations . onUserDeleted src/convex/client/auth-types.ts
authConfig? AuthConfig Override the default auth config (e.g. to add custom providers) - src/convex/client/auth-types.ts
authOptions? BetterAuthOptions Override Better Auth options (merged with defaults) - src/convex/client/auth-types.ts
basePath? string Override Better Auth basePath and matching Convex auth route - src/convex/client/auth-types.ts
admin? AdminOptions Admin plugin options: roles via adminRoles / ac , ban, impersonation. - src/convex/client/auth-types.ts
organization? OrganizationOptions & { invitationPath? : string ; } Organization (workspace) plugin options. - src/convex/client/auth-types.ts
mcp? McpAuthOptions Agent (MCP) OAuth provider options: the provider behind the app's OAuth-protected MCP endpoint and the /mcp/exchange token mint. - src/convex/client/auth-types.ts
--- ### AuthSetupComponents Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) The component handles the auth setup reads from your generated `components` object. Pass the whole object — the `backend` key is picked structurally. `backend` is the package's all-in-one component: its `adapter` module is the Better Auth CRUD surface. Auth email goes out through the `email` option (see [AuthIntegrations](#authintegrations)). #### Properties
Property Type Defined in
backend PublicAuthComponentRef src/convex/client/auth-types.ts
--- ### DeviceSession Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) One of the caller's device sessions, as `listSessions` returns it. #### Properties
Property Type Description Defined in
id string - src/convex/client/auth-types.ts
userAgent string | null - src/convex/client/auth-types.ts
createdAt number - src/convex/client/auth-types.ts
updatedAt number - src/convex/client/auth-types.ts
expiresAt number Epoch ms; a session past it no longer signs anyone in. src/convex/client/auth-types.ts
current boolean Whether this is the session the caller is signed in with. src/convex/client/auth-types.ts
--- ### McpExchange Defined in: [src/convex/integrations/mcp.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/integrations/mcp.ts) The agent token exchange `setupAuth` returns as `mcp`, for `registerBackendRoutes({ auth })`. #### Properties
Property Type Description Defined in
exchangeHandler ( ctx , request ) => Promise < Response > httpAction body for POST /mcp/exchange (wrapped by registerBackendRoutes ). src/convex/integrations/mcp.ts
## Type Aliases ### AuthEmail ```ts type AuthEmail = Pick; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) What the auth flows send their email through: the app's `setupEmail` instance, which holds the templates and sends through the package's own transport (the `backend` component's email module, on Resend). Restyle the sign-in code, welcome, account-deletion and invitation emails there, with `setupEmail(components, { templates })`. --- ### AuthRateLimitName ```ts type AuthRateLimitName = | "emailOtp" | "emailOtpGlobal" | "emailOtpAttempt" | "emailChange" | "mcp" | "admin" | "invitation" | "invitationGlobal" | "agentRegistrationGlobal"; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) The named rate limits the auth flows consult (a subset of the defaults): code sends — per email (`emailOtp`, keyed by a SHA-256 of the address) and deployment-wide (`emailOtpGlobal`, the backstop against mass probing) — code checks per address (`emailOtpAttempt`, keyed the same way), the agent token exchange `setupAuth` wires from the same options, the privileged routes throttled per caller (`admin`, `invitation`, and `emailChange` for the code an email change sends to the new address) with a deployment-wide ceiling behind the last two (`invitationGlobal`, `emailOtpGlobal`), and the anonymous agent registration route (`agentRegistrationGlobal`). --- ### OnUserCreated ```ts type OnUserCreated = (ctx, user) => Promise; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Fired once after a user is created — e.g. to kick off a welcome workflow. Receives the full request ctx (a mutation or action ctx for your data model), so it can `runMutation`, schedule work, or start a Workflow. #### Type Parameters
Type Parameter Default type
DM extends GenericDataModel GenericDataModel
#### Parameters
Parameter Type
ctx GenericMutationCtx < DM > | GenericActionCtx < DM >
user AuthCreatedUser
#### Returns `Promise`<`void`> --- ### OnUserDeleted ```ts type OnUserDeleted = (ctx, user) => Promise; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Fired once after a user account is deleted (the `deleteUser` flow, confirmed via email when a transport is wired) — e.g. to erase the app's own rows for that user, or the billing cache via `billing.forgetEntity`. Runs after a consumer-supplied `user.deleteUser.afterDelete`. #### Type Parameters
Type Parameter Default type
DM extends GenericDataModel GenericDataModel
#### Parameters
Parameter Type
ctx GenericMutationCtx < DM > | GenericActionCtx < DM >
user AuthDeletedUser
#### Returns `Promise`<`void`> --- ### CanSignInPurpose ```ts type CanSignInPurpose = "sign-in" | "user-create" | "session" | "email-change"; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Where a [CanSignIn](#cansignin) verdict is being asked for: - `'sign-in'` — an OTP sign-in code was requested for the address, before anything is sent. `isNewUser` says whether the address has an account. - `'user-create'` — an account is about to be created (any path). `isNewUser` is always `true`. - `'session'` — a session is about to be created for an existing account (OTP verification, passkey sign-in, …). `isNewUser` is always `false`. - `'email-change'` — a signed-in account asks to move to `email`, its new address: before a code goes to it, and again before the account moves. `isNewUser` is always `false`: the person already has an account. --- ### CanSignInVerdict ```ts type CanSignInVerdict = | true | { allowed: false; message?: string; }; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) A [CanSignIn](#cansignin) verdict: `true` to allow, or a refusal with an optional message shown to the user (default: "Sign-in is by invitation right now."). --- ### CanSignIn ```ts type CanSignIn = (ctx, input) => Promise; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Gate sign-in and account creation — e.g. an invite-only launch, an allow-list, or a closed beta. Consulted (with the full request ctx, so it can query the app's own tables) before an OTP is sent for a sign-in request, before any account is created, before a session is created for an existing account, and before an account moves to a new address (see [CanSignInPurpose](#cansigninpurpose)). A refusal surfaces as a `FORBIDDEN` `APIError` with the verdict's message — `useLoginFlow().error` shows it. A refusal at `'sign-in'` answers whoever typed the address, so a gate that refuses new addresses there tells anyone which addresses have an account. To keep that private, allow every `'sign-in'` and refuse at `'user-create'`: only the person holding the mailbox, who has the code, reads that refusal. #### Type Parameters
Type Parameter Default type
DM extends GenericDataModel GenericDataModel
#### Parameters
Parameter Type
ctx GenericMutationCtx < DM > | GenericActionCtx < DM >
input CanSignInInput
#### Returns `Promise`<[`CanSignInVerdict`](#cansigninverdict)> --- ### AdminPluginOptions ```ts type AdminPluginOptions = Parameters[0]; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Options for the bundled admin plugin (roles, permissions, ban, impersonation). --- ### OrganizationPluginOptions ```ts type OrganizationPluginOptions = Parameters[0] & { invitationPath?: string; }; ``` Defined in: [src/convex/client/auth-types.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/auth-types.ts) Options for the bundled organization plugin (workspaces). Every user gets a personal workspace on first sign-in, set active, so `activeOrganizationId` is never null. Beyond the plugin's own options: - `invitationPath` — the app page invitation emails link to (default `/accept-invitation`, registered automatically by the Nuxt module). The emailed URL is `{SITE_URL}{invitationPath}?id=`. ⚠ Declared in two places by necessity: keep it aligned with the Nuxt side's `backend.pages.acceptInvitation` (nuxt.config) — a mismatch 404s invitees, and `nuxt-backend doctor` cross-checks both. #### Type Declaration
Name Type Defined in
invitationPath? string src/convex/client/auth-types.ts
## Functions ### setupAuth() ```ts function setupAuth( components, queryBuilder, options ): { getAuthUser: RegisteredQuery<"public", { }, Promise<{ _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; }>>; authConfig: RegisteredQuery<"public", { }, Promise<{ invitationPath: string; agentLoginPath: string; agentConsentPath: string; }>>; listWorkspaces: RegisteredQuery<"public", { }, Promise< | { id: string; name: string; slug: string; logo: string | null; role: string; active: boolean; joinedAt: number; }[] | null>>; listWorkspaceMembers: RegisteredQuery<"public", { organizationId?: string; }, Promise< | { organizationId: string; members: { userId: string; name: string; email: string; role: string; joinedAt: number; }[]; } | null>>; updateProfile: RegisteredMutation<"public", { name: string; }, Promise>; listSessions: RegisteredQuery<"public", { }, Promise>; revokeSession: RegisteredMutation<"public", { sessionId: string; }, Promise>; authComponent: { adapter: (ctx) => AdapterFactory; getAnyUserById: (ctx, id) => Promise< | { _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; } | null>; setUserId: (ctx, authId, userId) => Promise; triggersApi: () => { onCreate: RegisteredMutation<"internal", { model: string; doc: any; }, Promise>; onUpdate: RegisteredMutation<"internal", { model: string; oldDoc: any; newDoc: any; }, Promise>; onDelete: RegisteredMutation<"internal", { model: string; doc: any; }, Promise>; }; registerRoutes: (http, createAuth, opts?) => void; registerRoutesLazy: (http, createAuth, opts?) => void; safeGetAuthUser: (ctx) => Promise< | { _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; } | undefined>; getAuthUser: (ctx) => Promise<{ _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; }>; getHeaders: (ctx) => Promise; getAuth: (createAuth, ctx) => Promise<{ auth: ReturnType; headers: Headers; }>; clientApi: () => { getAuthUser: RegisteredQuery<"public", { }, Promise<{ _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; }>>; }; }; createAuth: (ctx) => Auth<{ appName?: string; baseURL?: BaseURLConfig; secret?: string; secrets?: { version: number; value: string; }[]; secondaryStorage?: SecondaryStorage; emailVerification?: { sendVerificationEmail?: (data, request?) => Promise; sendOnSignUp?: boolean; sendOnSignIn?: boolean; autoSignInAfterVerification?: boolean; expiresIn?: number; beforeEmailVerification?: (user, request?) => Promise; afterEmailVerification?: (user, request?) => Promise; }; socialProviders?: SocialProviders; session?: BetterAuthDBOptions<"session", | "id" | "createdAt" | "updatedAt" | "userId" | "expiresAt" | "token" | "ipAddress" | "userAgent"> & { expiresIn?: number; updateAge?: number; disableSessionRefresh?: boolean; deferSessionRefresh?: boolean; storeSessionInDatabase?: boolean; preserveSessionInDatabase?: boolean; cookieCache?: { maxAge?: number; enabled?: boolean; strategy?: "jwt" | "compact" | "jwe"; refreshCache?: | boolean | { updateAge?: ...; }; version?: string | ((session, user) => ...) | ((session, user) => ...); }; freshAge?: number; }; account?: BetterAuthDBOptions<"account", | "id" | "createdAt" | "updatedAt" | "userId" | "accountId" | "providerId" | "accessToken" | "refreshToken" | "idToken" | "accessTokenExpiresAt" | "refreshTokenExpiresAt" | "scope" | "password"> & { updateAccountOnSignIn?: boolean; accountLinking?: { enabled?: boolean; disableImplicitLinking?: boolean; requireLocalEmailVerified?: boolean; trustedProviders?: ...[] | ((request?) => ...); allowDifferentEmails?: boolean; allowUnlinkingAll?: boolean; updateUserInfoOnLink?: boolean; }; encryptOAuthTokens?: boolean; skipStateCookieCheck?: boolean; storeStateStrategy?: "database" | "cookie"; storeAccountCookie?: boolean; }; verification?: BetterAuthDBOptions<"verification", "id" | "createdAt" | "updatedAt" | "expiresAt" | "identifier" | "value"> & { disableCleanup?: boolean; storeIdentifier?: | StoreIdentifierOption | { default: StoreIdentifierOption; overrides?: Record<..., ...>; }; storeInDatabase?: boolean; }; trustedOrigins?: | string[] | ((request?) => Awaitable<(string | null | undefined)[]>); advanced?: BetterAuthAdvancedOptions; logger?: Logger; databaseHooks?: { user?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; session?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; account?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; verification?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; }; onAPIError?: { throw?: boolean; onError?: (error, ctx) => void | Promise; errorURL?: string; customizeDefaultErrorPage?: { colors?: { background?: ... | ...; foreground?: ... | ...; primary?: ... | ...; primaryForeground?: ... | ...; mutedForeground?: ... | ...; border?: ... | ...; destructive?: ... | ...; titleBorder?: ... | ...; titleColor?: ... | ...; gridColor?: ... | ...; cardBackground?: ... | ...; cornerBorder?: ... | ...; }; size?: { radiusSm?: ... | ...; radiusMd?: ... | ...; radiusLg?: ... | ...; textSm?: ... | ...; text2xl?: ... | ...; text4xl?: ... | ...; text6xl?: ... | ...; }; font?: { defaultFamily?: ... | ...; monoFamily?: ... | ...; }; disableTitleBorder?: boolean; disableCornerDecorations?: boolean; disableBackgroundGrid?: boolean; }; }; telemetry?: { enabled?: boolean; debug?: boolean; }; experimental?: { joins?: boolean; instrumentation?: { enabled?: boolean; }; }; basePath: string; database: AdapterFactory; disabledPaths: string[]; emailAndPassword: { disableSignUp?: boolean; requireEmailVerification?: boolean; maxPasswordLength?: number; minPasswordLength?: number; sendResetPassword?: (data, request?) => Promise; resetPasswordTokenExpiresIn?: number; onPasswordReset?: (data, request?) => Promise; password?: { hash?: (password) => Promise; verify?: (data) => Promise; }; autoSignIn?: boolean; revokeSessionsOnPasswordReset?: boolean; onExistingUserSignUp?: (data, request?) => Promise; customSyntheticUser?: (params) => Record; enabled: boolean; }; user: { modelName?: "user" | LiteralString; fields?: Partial>; additionalFields?: { [key: string]: DBFieldAttribute; }; changeEmail?: { enabled: boolean; sendChangeEmailConfirmation?: (data, request?) => Promise; updateEmailWithoutVerification?: boolean; }; deleteUser?: { enabled?: boolean; sendDeleteAccountVerification?: (data, request?) => Promise; beforeDelete?: (user, request?) => Promise; afterDelete?: (user, request?) => Promise; deleteTokenExpiresIn?: number; }; }; rateLimit: { window?: number; max?: number; modelName?: "rateLimit" | LiteralString; fields?: Partial>; customRules?: { [key: string]: | false | BetterAuthRateLimitRule | ((request, currentRule) => Awaitable<... | ...>); }; storage?: "memory" | "database" | "secondary-storage"; customStorage?: BetterAuthRateLimitStorage; enabled: boolean; }; hooks: | { before?: MiddlewareHandler; after?: MiddlewareHandler; } | undefined; plugins: [{ id: "convex"; version: string; init: (ctx) => void; hooks: { before: ( | { matcher(context): boolean; handler: (inputContext) => ...; } | { matcher: (ctx) => ...; handler: (inputContext) => ...; })[]; after: { matcher: (context) => boolean; handler: MiddlewareHandler; }[]; }; endpoints: { getOpenIdConfig: StrictEndpoint<"/convex/.well-known/openid-configuration", { method: "GET"; metadata: { isAction: false; }; }, OIDCMetadata>; getJwks: StrictEndpoint<"/convex/jwks", { method: "GET"; metadata: { openapi: { description: ...; responses: ...; }; }; }, JSONWebKeySet>; getLatestJwks: StrictEndpoint<"/convex/latest-jwks", { isAction: boolean; method: "POST"; metadata: { SERVER_ONLY: true; openapi: { description: ...; }; }; }, any[]>; rotateKeys: StrictEndpoint<"/convex/rotate-keys", { isAction: boolean; method: "POST"; metadata: { SERVER_ONLY: true; openapi: { description: ...; }; }; }, any[]>; getToken: StrictEndpoint<"/convex/token", { method: "GET"; requireHeaders: true; use: ((inputContext) => ...)[]; metadata: { openapi: { description: ...; responses: ...; }; }; }, { token: string; }>; }; schema: { jwks: { fields: { publicKey: { type: "string"; required: true; }; privateKey: { type: "string"; required: true; }; createdAt: { type: "date"; required: true; }; expiresAt: { type: "date"; required: false; }; }; }; user: { fields: { userId: { type: "string"; required: false; input: false; }; }; }; }; }, ...(BetterAuthPlugin | { id: "email-otp"; version: string; init: any; endpoints: { sendVerificationOTP: StrictEndpoint<"/email-otp/send-verification-otp", { method: "POST"; use: (...)[]; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; createVerificationOTP: StrictEndpoint; metadata: { openapi: ... } }, string>; getVerificationOTP: StrictEndpoint; metadata: { openapi: ... } }, { otp: ... } | { otp: ... }>; checkVerificationOTP: StrictEndpoint<"/email-otp/check-verification-otp", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; verifyEmailOTP: StrictEndpoint<"/email-otp/verify-email", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { status: ...; token: ...; user: ... } | { status: ...; token: ...; user: ... }>; signInEmailOTP: StrictEndpoint<"/sign-in/email-otp", { method: "POST"; body: ZodIntersection<(...), (...)>; metadata: { openapi: ... } }, { token: string; user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... } }>; requestPasswordResetEmailOTP: StrictEndpoint<"/email-otp/request-password-reset", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; forgetPasswordEmailOTP: StrictEndpoint<"/forget-password/email-otp", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; resetPasswordEmailOTP: StrictEndpoint<"/email-otp/reset-password", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; requestEmailChangeEmailOTP: StrictEndpoint<"/email-otp/request-email-change", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; changeEmailEmailOTP: StrictEndpoint<"/email-otp/change-email", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }> }; hooks: { after: { matcher: any; handler: Middleware<(...), (...)> }[] }; rateLimit: ({ pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number })[]; options: EmailOTPOptions; $ERROR_CODES: { OTP_EXPIRED: RawError<"OTP_EXPIRED">; INVALID_OTP: RawError<"INVALID_OTP">; TOO_MANY_ATTEMPTS: RawError<"TOO_MANY_ATTEMPTS"> } } | { id: "passkey"; version: string; endpoints: { generatePasskeyRegistrationOptions: StrictEndpoint<"/passkey/generate-register-options", { method: "GET"; use: (...)[]; query: ZodOptional<(...)>; metadata: { openapi: ... } }, PublicKeyCredentialCreationOptionsJSON>; generatePasskeyAuthenticationOptions: StrictEndpoint<"/passkey/generate-authenticate-options", { method: "GET"; metadata: { openapi: ... } }, PublicKeyCredentialRequestOptionsJSON>; verifyPasskeyRegistration: StrictEndpoint<"/passkey/verify-registration", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, Passkey>; verifyPasskeyAuthentication: StrictEndpoint<"/passkey/verify-authentication", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { session: { id: ...; createdAt: ...; updatedAt: ...; userId: ...; expiresAt: ...; token: ...; ipAddress?: ...; userAgent?: ... }; user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... } }>; listPasskeys: StrictEndpoint<"/passkey/list-user-passkeys", { method: "GET"; use: (...)[]; metadata: { openapi: ... } }, Passkey[]>; deletePasskey: StrictEndpoint<"/passkey/delete-passkey", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { status: boolean }>; updatePasskey: StrictEndpoint<"/passkey/update-passkey", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { passkey: Passkey }> }; schema: { passkey: { fields: { name: { type: ...; required: ... }; publicKey: { type: ...; required: ... }; userId: { type: ...; references: ...; required: ...; index: ... }; credentialID: { type: ...; required: ...; index: ... }; counter: { type: ...; required: ... }; deviceType: { type: ...; required: ... }; backedUp: { type: ...; required: ... }; transports: { type: ...; required: ... }; createdAt: { type: ...; required: ... }; aaguid: { type: ...; required: ... } } } }; $ERROR_CODES: { CHALLENGE_NOT_FOUND: RawError<"CHALLENGE_NOT_FOUND">; YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: RawError<"YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY">; FAILED_TO_VERIFY_REGISTRATION: RawError<"FAILED_TO_VERIFY_REGISTRATION">; PASSKEY_NOT_FOUND: RawError<"PASSKEY_NOT_FOUND">; AUTHENTICATION_FAILED: RawError<"AUTHENTICATION_FAILED">; UNABLE_TO_CREATE_SESSION: RawError<"UNABLE_TO_CREATE_SESSION">; FAILED_TO_UPDATE_PASSKEY: RawError<"FAILED_TO_UPDATE_PASSKEY">; PREVIOUSLY_REGISTERED: RawError<"PREVIOUSLY_REGISTERED">; REGISTRATION_CANCELLED: RawError<"REGISTRATION_CANCELLED">; AUTH_CANCELLED: RawError<"AUTH_CANCELLED">; UNKNOWN_ERROR: RawError<"UNKNOWN_ERROR">; SESSION_REQUIRED: RawError<"SESSION_REQUIRED">; RESOLVE_USER_REQUIRED: RawError<"RESOLVE_USER_REQUIRED">; RESOLVED_USER_INVALID: RawError<"RESOLVED_USER_INVALID"> }; options: PasskeyOptions | undefined } | { id: "admin"; version: string; init: any; hooks: { after: { matcher: any; handler: Middleware<(...), (...)> }[] }; endpoints: { setRole: StrictEndpoint<"/admin/set-role", { method: "POST"; body: ZodObject<(...), (...)>; requireHeaders: true; use: (...)[]; metadata: { openapi: ...; $Infer: ... } }, { user: UserWithRole }>; getUser: StrictEndpoint<"/admin/get-user", { method: "GET"; query: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, UserWithRole>; createUser: StrictEndpoint<"/admin/create-user", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { user: UserWithRole }>; adminUpdateUser: StrictEndpoint<"/admin/update-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, UserWithRole>; listUsers: StrictEndpoint<"/admin/list-users", { method: "GET"; use: (...)[]; query: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { users: (...)[]; total: number }>; listUserSessions: StrictEndpoint<"/admin/list-user-sessions", { method: "POST"; use: (...)[]; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { sessions: (...)[] }>; unbanUser: StrictEndpoint<"/admin/unban-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { user: UserWithRole }>; banUser: StrictEndpoint<"/admin/ban-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { user: UserWithRole }>; impersonateUser: StrictEndpoint<"/admin/impersonate-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { session: { id: ...; createdAt: ...; updatedAt: ...; userId: ...; expiresAt: ...; token: ...; ipAddress?: ...; userAgent?: ... }; user: UserWithRole }>; stopImpersonating: StrictEndpoint<"/admin/stop-impersonating", { method: "POST"; requireHeaders: true }, { session: (...) & (...); user: (...) & (...) }>; revokeUserSession: StrictEndpoint<"/admin/revoke-user-session", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; revokeUserSessions: StrictEndpoint<"/admin/revoke-user-sessions", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; removeUser: StrictEndpoint<"/admin/remove-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; setUserPassword: StrictEndpoint<"/admin/set-user-password", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { status: boolean }>; userHasPermission: StrictEndpoint<"/admin/has-permission", { method: "POST"; body: ZodIntersection<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { error: null; success: boolean }> }; $ERROR_CODES: { USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">; FAILED_TO_CREATE_USER: RawError<"FAILED_TO_CREATE_USER">; USER_ALREADY_EXISTS: RawError<"USER_ALREADY_EXISTS">; YOU_CANNOT_BAN_YOURSELF: RawError<"YOU_CANNOT_BAN_YOURSELF">; YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">; YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">; YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">; YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">; YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">; YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">; YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">; YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">; YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">; BANNED_USER: RawError<"BANNED_USER">; YOU_ARE_NOT_ALLOWED_TO_GET_USER: RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">; NO_DATA_TO_UPDATE: RawError<"NO_DATA_TO_UPDATE">; YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">; YOU_CANNOT_REMOVE_YOURSELF: RawError<"YOU_CANNOT_REMOVE_YOURSELF">; YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">; YOU_CANNOT_IMPERSONATE_ADMINS: RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">; INVALID_ROLE_TYPE: RawError<"INVALID_ROLE_TYPE">; YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">; PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER"> }; schema: { user: { fields: { role: { type: ...; required: ...; input: ... }; banned: { type: ...; defaultValue: ...; required: ...; input: ... }; banReason: { type: ...; required: ...; input: ... }; banExpires: { type: ...; required: ...; input: ... } } }; session: { fields: { impersonatedBy: { type: ...; required: ...; input: ... } } } }; options: NoInfer } | DefaultOrganizationPlugin<{ allowUserToCreateOrganization?: boolean | ((user: (...) & (...)) => Awaitable<(...)>); organizationLimit?: number | ((user: (...) & (...)) => Awaitable<(...)>); creatorRole?: string; membershipLimit?: number | ((user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... }, organization: { id: ...; name: ...; slug: ...; logo?: ...; metadata?: ...; createdAt: ... }) => (...) | (...)); ac?: AccessControl; roles?: { [key: string]: (...) | (...) }; dynamicAccessControl?: { enabled?: (...) | (...) | (...); maximumRolesPerOrganization?: (...) | (...) | (...) }; teams?: { enabled: boolean; defaultTeam?: (...) | (...); maximumTeams?: (...) | (...) | (...); maximumMembersPerTeam?: (...) | (...) | (...); allowRemovingAllTeams?: (...) | (...) | (...) }; invitationExpiresIn?: number; invitationLimit?: number | ((data: { user: ...; organization: ...; member: ... }, ctx: AuthContext) => Awaitable<(...)>); cancelPendingInvitationsOnReInvite?: boolean; requireEmailVerificationOnInvitation?: boolean; sendInvitationEmail?: (data: { id: ...; role: ...; email: ...; organization: ...; invitation: ...; inviter: ... }, request?: (...) | (...)) => Promise<(...)>; schema?: { session?: (...) | (...); organization?: (...) | (...); member?: (...) | (...); invitation?: (...) | (...); team?: (...) | (...); teamMember?: (...) | (...); organizationRole?: (...) | (...) }; disableOrganizationDeletion?: boolean; organizationHooks?: { beforeCreateOrganization?: (...) | (...); afterCreateOrganization?: (...) | (...); beforeUpdateOrganization?: (...) | (...); afterUpdateOrganization?: (...) | (...); beforeDeleteOrganization?: (...) | (...); afterDeleteOrganization?: (...) | (...); beforeAddMember?: (...) | (...); afterAddMember?: (...) | (...); beforeRemoveMember?: (...) | (...); afterRemoveMember?: (...) | (...); beforeUpdateMemberRole?: (...) | (...); afterUpdateMemberRole?: (...) | (...); beforeCreateInvitation?: (...) | (...); afterCreateInvitation?: (...) | (...); beforeAcceptInvitation?: (...) | (...); afterAcceptInvitation?: (...) | (...); beforeRejectInvitation?: (...) | (...); afterRejectInvitation?: (...) | (...); beforeCancelInvitation?: (...) | (...); afterCancelInvitation?: (...) | (...); beforeCreateTeam?: (...) | (...); afterCreateTeam?: (...) | (...); beforeUpdateTeam?: (...) | (...); afterUpdateTeam?: (...) | (...); beforeDeleteTeam?: (...) | (...); afterDeleteTeam?: (...) | (...); beforeAddTeamMember?: (...) | (...); afterAddTeamMember?: (...) | (...); beforeRemoveTeamMember?: (...) | (...); afterRemoveTeamMember?: (...) | (...) } }>)[]]; }>; mcp: McpExchange; }; ``` Defined in: [src/convex/client/index.ts](https://github.com/qruto/nuxt-backend/blob/main/src/convex/client/index.ts) The app's auth, from one call: the auth instance factory, the functions the scaffold re-exports, and the agent token exchange. Every auth email goes out through the `email` instance, with the templates it holds. #### Type Parameters
Type Parameter
DM extends GenericDataModel
#### Parameters
Parameter Type
components AuthSetupComponents
queryBuilder QueryBuilder < DM , "public" >
options SetupAuthOptions < DM >
#### Returns ```ts { getAuthUser: RegisteredQuery<"public", { }, Promise<{ _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; }>>; authConfig: RegisteredQuery<"public", { }, Promise<{ invitationPath: string; agentLoginPath: string; agentConsentPath: string; }>>; listWorkspaces: RegisteredQuery<"public", { }, Promise< | { id: string; name: string; slug: string; logo: string | null; role: string; active: boolean; joinedAt: number; }[] | null>>; listWorkspaceMembers: RegisteredQuery<"public", { organizationId?: string; }, Promise< | { organizationId: string; members: { userId: string; name: string; email: string; role: string; joinedAt: number; }[]; } | null>>; updateProfile: RegisteredMutation<"public", { name: string; }, Promise>; listSessions: RegisteredQuery<"public", { }, Promise>; revokeSession: RegisteredMutation<"public", { sessionId: string; }, Promise>; authComponent: { adapter: (ctx) => AdapterFactory; getAnyUserById: (ctx, id) => Promise< | { _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; } | null>; setUserId: (ctx, authId, userId) => Promise; triggersApi: () => { onCreate: RegisteredMutation<"internal", { model: string; doc: any; }, Promise>; onUpdate: RegisteredMutation<"internal", { model: string; oldDoc: any; newDoc: any; }, Promise>; onDelete: RegisteredMutation<"internal", { model: string; doc: any; }, Promise>; }; registerRoutes: (http, createAuth, opts?) => void; registerRoutesLazy: (http, createAuth, opts?) => void; safeGetAuthUser: (ctx) => Promise< | { _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; } | undefined>; getAuthUser: (ctx) => Promise<{ _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; }>; getHeaders: (ctx) => Promise; getAuth: (createAuth, ctx) => Promise<{ auth: ReturnType; headers: Headers; }>; clientApi: () => { getAuthUser: RegisteredQuery<"public", { }, Promise<{ _creationTime: number; _id: Id<"user">; image?: string | null; role?: string | null; banned?: boolean | null; banReason?: string | null; banExpires?: number | null; userId?: string | null; name: string; email: string; emailVerified: boolean; createdAt: number; updatedAt: number; }>>; }; }; createAuth: (ctx) => Auth<{ appName?: string; baseURL?: BaseURLConfig; secret?: string; secrets?: { version: number; value: string; }[]; secondaryStorage?: SecondaryStorage; emailVerification?: { sendVerificationEmail?: (data, request?) => Promise; sendOnSignUp?: boolean; sendOnSignIn?: boolean; autoSignInAfterVerification?: boolean; expiresIn?: number; beforeEmailVerification?: (user, request?) => Promise; afterEmailVerification?: (user, request?) => Promise; }; socialProviders?: SocialProviders; session?: BetterAuthDBOptions<"session", | "id" | "createdAt" | "updatedAt" | "userId" | "expiresAt" | "token" | "ipAddress" | "userAgent"> & { expiresIn?: number; updateAge?: number; disableSessionRefresh?: boolean; deferSessionRefresh?: boolean; storeSessionInDatabase?: boolean; preserveSessionInDatabase?: boolean; cookieCache?: { maxAge?: number; enabled?: boolean; strategy?: "jwt" | "compact" | "jwe"; refreshCache?: | boolean | { updateAge?: ...; }; version?: string | ((session, user) => ...) | ((session, user) => ...); }; freshAge?: number; }; account?: BetterAuthDBOptions<"account", | "id" | "createdAt" | "updatedAt" | "userId" | "accountId" | "providerId" | "accessToken" | "refreshToken" | "idToken" | "accessTokenExpiresAt" | "refreshTokenExpiresAt" | "scope" | "password"> & { updateAccountOnSignIn?: boolean; accountLinking?: { enabled?: boolean; disableImplicitLinking?: boolean; requireLocalEmailVerified?: boolean; trustedProviders?: ...[] | ((request?) => ...); allowDifferentEmails?: boolean; allowUnlinkingAll?: boolean; updateUserInfoOnLink?: boolean; }; encryptOAuthTokens?: boolean; skipStateCookieCheck?: boolean; storeStateStrategy?: "database" | "cookie"; storeAccountCookie?: boolean; }; verification?: BetterAuthDBOptions<"verification", "id" | "createdAt" | "updatedAt" | "expiresAt" | "identifier" | "value"> & { disableCleanup?: boolean; storeIdentifier?: | StoreIdentifierOption | { default: StoreIdentifierOption; overrides?: Record<..., ...>; }; storeInDatabase?: boolean; }; trustedOrigins?: | string[] | ((request?) => Awaitable<(string | null | undefined)[]>); advanced?: BetterAuthAdvancedOptions; logger?: Logger; databaseHooks?: { user?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; session?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; account?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; verification?: { create?: { before?: ... | ...; after?: ... | ...; }; update?: { before?: ... | ...; after?: ... | ...; }; delete?: { before?: ... | ...; after?: ... | ...; }; }; }; onAPIError?: { throw?: boolean; onError?: (error, ctx) => void | Promise; errorURL?: string; customizeDefaultErrorPage?: { colors?: { background?: ... | ...; foreground?: ... | ...; primary?: ... | ...; primaryForeground?: ... | ...; mutedForeground?: ... | ...; border?: ... | ...; destructive?: ... | ...; titleBorder?: ... | ...; titleColor?: ... | ...; gridColor?: ... | ...; cardBackground?: ... | ...; cornerBorder?: ... | ...; }; size?: { radiusSm?: ... | ...; radiusMd?: ... | ...; radiusLg?: ... | ...; textSm?: ... | ...; text2xl?: ... | ...; text4xl?: ... | ...; text6xl?: ... | ...; }; font?: { defaultFamily?: ... | ...; monoFamily?: ... | ...; }; disableTitleBorder?: boolean; disableCornerDecorations?: boolean; disableBackgroundGrid?: boolean; }; }; telemetry?: { enabled?: boolean; debug?: boolean; }; experimental?: { joins?: boolean; instrumentation?: { enabled?: boolean; }; }; basePath: string; database: AdapterFactory; disabledPaths: string[]; emailAndPassword: { disableSignUp?: boolean; requireEmailVerification?: boolean; maxPasswordLength?: number; minPasswordLength?: number; sendResetPassword?: (data, request?) => Promise; resetPasswordTokenExpiresIn?: number; onPasswordReset?: (data, request?) => Promise; password?: { hash?: (password) => Promise; verify?: (data) => Promise; }; autoSignIn?: boolean; revokeSessionsOnPasswordReset?: boolean; onExistingUserSignUp?: (data, request?) => Promise; customSyntheticUser?: (params) => Record; enabled: boolean; }; user: { modelName?: "user" | LiteralString; fields?: Partial>; additionalFields?: { [key: string]: DBFieldAttribute; }; changeEmail?: { enabled: boolean; sendChangeEmailConfirmation?: (data, request?) => Promise; updateEmailWithoutVerification?: boolean; }; deleteUser?: { enabled?: boolean; sendDeleteAccountVerification?: (data, request?) => Promise; beforeDelete?: (user, request?) => Promise; afterDelete?: (user, request?) => Promise; deleteTokenExpiresIn?: number; }; }; rateLimit: { window?: number; max?: number; modelName?: "rateLimit" | LiteralString; fields?: Partial>; customRules?: { [key: string]: | false | BetterAuthRateLimitRule | ((request, currentRule) => Awaitable<... | ...>); }; storage?: "memory" | "database" | "secondary-storage"; customStorage?: BetterAuthRateLimitStorage; enabled: boolean; }; hooks: | { before?: MiddlewareHandler; after?: MiddlewareHandler; } | undefined; plugins: [{ id: "convex"; version: string; init: (ctx) => void; hooks: { before: ( | { matcher(context): boolean; handler: (inputContext) => ...; } | { matcher: (ctx) => ...; handler: (inputContext) => ...; })[]; after: { matcher: (context) => boolean; handler: MiddlewareHandler; }[]; }; endpoints: { getOpenIdConfig: StrictEndpoint<"/convex/.well-known/openid-configuration", { method: "GET"; metadata: { isAction: false; }; }, OIDCMetadata>; getJwks: StrictEndpoint<"/convex/jwks", { method: "GET"; metadata: { openapi: { description: ...; responses: ...; }; }; }, JSONWebKeySet>; getLatestJwks: StrictEndpoint<"/convex/latest-jwks", { isAction: boolean; method: "POST"; metadata: { SERVER_ONLY: true; openapi: { description: ...; }; }; }, any[]>; rotateKeys: StrictEndpoint<"/convex/rotate-keys", { isAction: boolean; method: "POST"; metadata: { SERVER_ONLY: true; openapi: { description: ...; }; }; }, any[]>; getToken: StrictEndpoint<"/convex/token", { method: "GET"; requireHeaders: true; use: ((inputContext) => ...)[]; metadata: { openapi: { description: ...; responses: ...; }; }; }, { token: string; }>; }; schema: { jwks: { fields: { publicKey: { type: "string"; required: true; }; privateKey: { type: "string"; required: true; }; createdAt: { type: "date"; required: true; }; expiresAt: { type: "date"; required: false; }; }; }; user: { fields: { userId: { type: "string"; required: false; input: false; }; }; }; }; }, ...(BetterAuthPlugin | { id: "email-otp"; version: string; init: any; endpoints: { sendVerificationOTP: StrictEndpoint<"/email-otp/send-verification-otp", { method: "POST"; use: (...)[]; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; createVerificationOTP: StrictEndpoint; metadata: { openapi: ... } }, string>; getVerificationOTP: StrictEndpoint; metadata: { openapi: ... } }, { otp: ... } | { otp: ... }>; checkVerificationOTP: StrictEndpoint<"/email-otp/check-verification-otp", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; verifyEmailOTP: StrictEndpoint<"/email-otp/verify-email", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { status: ...; token: ...; user: ... } | { status: ...; token: ...; user: ... }>; signInEmailOTP: StrictEndpoint<"/sign-in/email-otp", { method: "POST"; body: ZodIntersection<(...), (...)>; metadata: { openapi: ... } }, { token: string; user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... } }>; requestPasswordResetEmailOTP: StrictEndpoint<"/email-otp/request-password-reset", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; forgetPasswordEmailOTP: StrictEndpoint<"/forget-password/email-otp", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; resetPasswordEmailOTP: StrictEndpoint<"/email-otp/reset-password", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; requestEmailChangeEmailOTP: StrictEndpoint<"/email-otp/request-email-change", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; changeEmailEmailOTP: StrictEndpoint<"/email-otp/change-email", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }> }; hooks: { after: { matcher: any; handler: Middleware<(...), (...)> }[] }; rateLimit: ({ pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number })[]; options: EmailOTPOptions; $ERROR_CODES: { OTP_EXPIRED: RawError<"OTP_EXPIRED">; INVALID_OTP: RawError<"INVALID_OTP">; TOO_MANY_ATTEMPTS: RawError<"TOO_MANY_ATTEMPTS"> } } | { id: "passkey"; version: string; endpoints: { generatePasskeyRegistrationOptions: StrictEndpoint<"/passkey/generate-register-options", { method: "GET"; use: (...)[]; query: ZodOptional<(...)>; metadata: { openapi: ... } }, PublicKeyCredentialCreationOptionsJSON>; generatePasskeyAuthenticationOptions: StrictEndpoint<"/passkey/generate-authenticate-options", { method: "GET"; metadata: { openapi: ... } }, PublicKeyCredentialRequestOptionsJSON>; verifyPasskeyRegistration: StrictEndpoint<"/passkey/verify-registration", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, Passkey>; verifyPasskeyAuthentication: StrictEndpoint<"/passkey/verify-authentication", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { session: { id: ...; createdAt: ...; updatedAt: ...; userId: ...; expiresAt: ...; token: ...; ipAddress?: ...; userAgent?: ... }; user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... } }>; listPasskeys: StrictEndpoint<"/passkey/list-user-passkeys", { method: "GET"; use: (...)[]; metadata: { openapi: ... } }, Passkey[]>; deletePasskey: StrictEndpoint<"/passkey/delete-passkey", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { status: boolean }>; updatePasskey: StrictEndpoint<"/passkey/update-passkey", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { passkey: Passkey }> }; schema: { passkey: { fields: { name: { type: ...; required: ... }; publicKey: { type: ...; required: ... }; userId: { type: ...; references: ...; required: ...; index: ... }; credentialID: { type: ...; required: ...; index: ... }; counter: { type: ...; required: ... }; deviceType: { type: ...; required: ... }; backedUp: { type: ...; required: ... }; transports: { type: ...; required: ... }; createdAt: { type: ...; required: ... }; aaguid: { type: ...; required: ... } } } }; $ERROR_CODES: { CHALLENGE_NOT_FOUND: RawError<"CHALLENGE_NOT_FOUND">; YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: RawError<"YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY">; FAILED_TO_VERIFY_REGISTRATION: RawError<"FAILED_TO_VERIFY_REGISTRATION">; PASSKEY_NOT_FOUND: RawError<"PASSKEY_NOT_FOUND">; AUTHENTICATION_FAILED: RawError<"AUTHENTICATION_FAILED">; UNABLE_TO_CREATE_SESSION: RawError<"UNABLE_TO_CREATE_SESSION">; FAILED_TO_UPDATE_PASSKEY: RawError<"FAILED_TO_UPDATE_PASSKEY">; PREVIOUSLY_REGISTERED: RawError<"PREVIOUSLY_REGISTERED">; REGISTRATION_CANCELLED: RawError<"REGISTRATION_CANCELLED">; AUTH_CANCELLED: RawError<"AUTH_CANCELLED">; UNKNOWN_ERROR: RawError<"UNKNOWN_ERROR">; SESSION_REQUIRED: RawError<"SESSION_REQUIRED">; RESOLVE_USER_REQUIRED: RawError<"RESOLVE_USER_REQUIRED">; RESOLVED_USER_INVALID: RawError<"RESOLVED_USER_INVALID"> }; options: PasskeyOptions | undefined } | { id: "admin"; version: string; init: any; hooks: { after: { matcher: any; handler: Middleware<(...), (...)> }[] }; endpoints: { setRole: StrictEndpoint<"/admin/set-role", { method: "POST"; body: ZodObject<(...), (...)>; requireHeaders: true; use: (...)[]; metadata: { openapi: ...; $Infer: ... } }, { user: UserWithRole }>; getUser: StrictEndpoint<"/admin/get-user", { method: "GET"; query: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, UserWithRole>; createUser: StrictEndpoint<"/admin/create-user", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { user: UserWithRole }>; adminUpdateUser: StrictEndpoint<"/admin/update-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, UserWithRole>; listUsers: StrictEndpoint<"/admin/list-users", { method: "GET"; use: (...)[]; query: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { users: (...)[]; total: number }>; listUserSessions: StrictEndpoint<"/admin/list-user-sessions", { method: "POST"; use: (...)[]; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { sessions: (...)[] }>; unbanUser: StrictEndpoint<"/admin/unban-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { user: UserWithRole }>; banUser: StrictEndpoint<"/admin/ban-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { user: UserWithRole }>; impersonateUser: StrictEndpoint<"/admin/impersonate-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { session: { id: ...; createdAt: ...; updatedAt: ...; userId: ...; expiresAt: ...; token: ...; ipAddress?: ...; userAgent?: ... }; user: UserWithRole }>; stopImpersonating: StrictEndpoint<"/admin/stop-impersonating", { method: "POST"; requireHeaders: true }, { session: (...) & (...); user: (...) & (...) }>; revokeUserSession: StrictEndpoint<"/admin/revoke-user-session", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; revokeUserSessions: StrictEndpoint<"/admin/revoke-user-sessions", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; removeUser: StrictEndpoint<"/admin/remove-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; setUserPassword: StrictEndpoint<"/admin/set-user-password", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { status: boolean }>; userHasPermission: StrictEndpoint<"/admin/has-permission", { method: "POST"; body: ZodIntersection<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { error: null; success: boolean }> }; $ERROR_CODES: { USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">; FAILED_TO_CREATE_USER: RawError<"FAILED_TO_CREATE_USER">; USER_ALREADY_EXISTS: RawError<"USER_ALREADY_EXISTS">; YOU_CANNOT_BAN_YOURSELF: RawError<"YOU_CANNOT_BAN_YOURSELF">; YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">; YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">; YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">; YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">; YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">; YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">; YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">; YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">; YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">; BANNED_USER: RawError<"BANNED_USER">; YOU_ARE_NOT_ALLOWED_TO_GET_USER: RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">; NO_DATA_TO_UPDATE: RawError<"NO_DATA_TO_UPDATE">; YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">; YOU_CANNOT_REMOVE_YOURSELF: RawError<"YOU_CANNOT_REMOVE_YOURSELF">; YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">; YOU_CANNOT_IMPERSONATE_ADMINS: RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">; INVALID_ROLE_TYPE: RawError<"INVALID_ROLE_TYPE">; YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">; PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER"> }; schema: { user: { fields: { role: { type: ...; required: ...; input: ... }; banned: { type: ...; defaultValue: ...; required: ...; input: ... }; banReason: { type: ...; required: ...; input: ... }; banExpires: { type: ...; required: ...; input: ... } } }; session: { fields: { impersonatedBy: { type: ...; required: ...; input: ... } } } }; options: NoInfer } | DefaultOrganizationPlugin<{ allowUserToCreateOrganization?: boolean | ((user: (...) & (...)) => Awaitable<(...)>); organizationLimit?: number | ((user: (...) & (...)) => Awaitable<(...)>); creatorRole?: string; membershipLimit?: number | ((user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... }, organization: { id: ...; name: ...; slug: ...; logo?: ...; metadata?: ...; createdAt: ... }) => (...) | (...)); ac?: AccessControl; roles?: { [key: string]: (...) | (...) }; dynamicAccessControl?: { enabled?: (...) | (...) | (...); maximumRolesPerOrganization?: (...) | (...) | (...) }; teams?: { enabled: boolean; defaultTeam?: (...) | (...); maximumTeams?: (...) | (...) | (...); maximumMembersPerTeam?: (...) | (...) | (...); allowRemovingAllTeams?: (...) | (...) | (...) }; invitationExpiresIn?: number; invitationLimit?: number | ((data: { user: ...; organization: ...; member: ... }, ctx: AuthContext) => Awaitable<(...)>); cancelPendingInvitationsOnReInvite?: boolean; requireEmailVerificationOnInvitation?: boolean; sendInvitationEmail?: (data: { id: ...; role: ...; email: ...; organization: ...; invitation: ...; inviter: ... }, request?: (...) | (...)) => Promise<(...)>; schema?: { session?: (...) | (...); organization?: (...) | (...); member?: (...) | (...); invitation?: (...) | (...); team?: (...) | (...); teamMember?: (...) | (...); organizationRole?: (...) | (...) }; disableOrganizationDeletion?: boolean; organizationHooks?: { beforeCreateOrganization?: (...) | (...); afterCreateOrganization?: (...) | (...); beforeUpdateOrganization?: (...) | (...); afterUpdateOrganization?: (...) | (...); beforeDeleteOrganization?: (...) | (...); afterDeleteOrganization?: (...) | (...); beforeAddMember?: (...) | (...); afterAddMember?: (...) | (...); beforeRemoveMember?: (...) | (...); afterRemoveMember?: (...) | (...); beforeUpdateMemberRole?: (...) | (...); afterUpdateMemberRole?: (...) | (...); beforeCreateInvitation?: (...) | (...); afterCreateInvitation?: (...) | (...); beforeAcceptInvitation?: (...) | (...); afterAcceptInvitation?: (...) | (...); beforeRejectInvitation?: (...) | (...); afterRejectInvitation?: (...) | (...); beforeCancelInvitation?: (...) | (...); afterCancelInvitation?: (...) | (...); beforeCreateTeam?: (...) | (...); afterCreateTeam?: (...) | (...); beforeUpdateTeam?: (...) | (...); afterUpdateTeam?: (...) | (...); beforeDeleteTeam?: (...) | (...); afterDeleteTeam?: (...) | (...); beforeAddTeamMember?: (...) | (...); afterAddTeamMember?: (...) | (...); beforeRemoveTeamMember?: (...) | (...); afterRemoveTeamMember?: (...) | (...) } }>)[]]; }>; mcp: McpExchange; } ```
Name Type Description Defined in
getAuthUser RegisteredQuery < "public" , { }, Promise <{ _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; }>> - src/convex/client/index.ts
authConfig RegisteredQuery < "public" , { }, Promise <{ invitationPath : string ; agentLoginPath : string ; agentConsentPath : string ; }>> - src/convex/client/index.ts
listWorkspaces RegisteredQuery < "public" , { }, Promise < | { id : string ; name : string ; slug : string ; logo : string | null ; role : string ; active : boolean ; joinedAt : number ; } | null >> - src/convex/client/index.ts
listWorkspaceMembers RegisteredQuery < "public" , { organizationId? : string ; }, Promise < | { organizationId : string ; members : { userId : string ; name : string ; email : string ; role : string ; joinedAt : number ; } ; } | null >> - src/convex/client/index.ts
updateProfile RegisteredMutation < "public" , { name : string ; }, Promise < null >> - src/convex/client/index.ts
listSessions RegisteredQuery < "public" , { }, Promise < DeviceSession | null >> - src/convex/client/index.ts
revokeSession RegisteredMutation < "public" , { sessionId : string ; }, Promise < null >> - src/convex/client/index.ts
authComponent { adapter : ( ctx ) => AdapterFactory < BetterAuthOptions >; getAnyUserById : ( ctx , id ) => Promise < | { _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; } | null >; setUserId : ( ctx , authId , userId ) => Promise < void >; triggersApi : () => { onCreate : RegisteredMutation < "internal" , { model : string ; doc : any ; }, Promise < void >>; onUpdate : RegisteredMutation < "internal" , { model : string ; oldDoc : any ; newDoc : any ; }, Promise < void >>; onDelete : RegisteredMutation < "internal" , { model : string ; doc : any ; }, Promise < void >>; }; registerRoutes : ( http , createAuth , opts? ) => void ; registerRoutesLazy : < T >( http , createAuth , opts? ) => void ; safeGetAuthUser : ( ctx ) => Promise < | { _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; } | undefined >; getAuthUser : ( ctx ) => Promise <{ _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; }>; getHeaders : ( ctx ) => Promise < Headers >; getAuth : < T >( createAuth , ctx ) => Promise <{ auth : ReturnType < T >; headers : Headers ; }>; clientApi : () => { getAuthUser : RegisteredQuery < "public" , { }, Promise <{ _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; }>>; }; } - src/convex/client/index.ts
authComponent.adapter() ( ctx ) => AdapterFactory < BetterAuthOptions > Returns the Convex database adapter for use in Better Auth options. node_modules/@convex-dev/better-auth/dist/client/create-client.d.ts:87
authComponent.getAnyUserById() ( ctx , id ) => Promise < | { _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; } | null > Returns a user by their Better Auth user id. node_modules/@convex-dev/better-auth/dist/client/create-client.d.ts:132
authComponent.setUserId() ( ctx , authId , userId ) => Promise < void > Replaces 0.7 behavior of returning a new user id from onCreateUser Deprecated in 0.9 node_modules/@convex-dev/better-auth/dist/client/create-client.d.ts:141
authComponent.triggersApi() () => { onCreate : RegisteredMutation < "internal" , { model : string ; doc : any ; }, Promise < void >>; onUpdate : RegisteredMutation < "internal" , { model : string ; oldDoc : any ; newDoc : any ; }, Promise < void >>; onDelete : RegisteredMutation < "internal" , { model : string ; doc : any ; }, Promise < void >>; } Exposes functions for executing trigger callbacks in the app context. Callbacks are defined in the triggers option to the component client config. See createClient for more information. node_modules/@convex-dev/better-auth/dist/client/create-client.d.ts:168
authComponent.registerRoutes() ( http , createAuth , opts? ) => void - node_modules/@convex-dev/better-auth/dist/client/create-client.d.ts:183
authComponent.registerRoutesLazy() < T >( http , createAuth , opts? ) => void - node_modules/@convex-dev/better-auth/dist/client/create-client.d.ts:190
authComponent.safeGetAuthUser() ( ctx ) => Promise < | { _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; } | undefined > - src/convex/client/component.ts
authComponent.getAuthUser() ( ctx ) => Promise <{ _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; }> - src/convex/client/component.ts
authComponent.getHeaders() ( ctx ) => Promise < Headers > - src/convex/client/component.ts
authComponent.getAuth() < T >( createAuth , ctx ) => Promise <{ auth : ReturnType < T >; headers : Headers ; }> - src/convex/client/component.ts
authComponent.clientApi() () => { getAuthUser : RegisteredQuery < "public" , { }, Promise <{ _creationTime : number ; _id : Id < "user" >; image? : string | null ; role? : string | null ; banned? : boolean | null ; banReason? : string | null ; banExpires? : number | null ; userId? : string | null ; name : string ; email : string ; emailVerified : boolean ; createdAt : number ; updatedAt : number ; }>>; } - src/convex/client/component.ts
createAuth() ( ctx ) => Auth <{ appName? : string ; baseURL? : BaseURLConfig ; secret? : string ; secrets? : { version : number ; value : string ; } ; secondaryStorage? : SecondaryStorage ; emailVerification? : { sendVerificationEmail? : ( data , request? ) => Promise < void >; sendOnSignUp? : boolean ; sendOnSignIn? : boolean ; autoSignInAfterVerification? : boolean ; expiresIn? : number ; beforeEmailVerification? : ( user , request? ) => Promise < void >; afterEmailVerification? : ( user , request? ) => Promise < void >; }; socialProviders? : SocialProviders ; session? : BetterAuthDBOptions < "session" , | "id" | "createdAt" | "updatedAt" | "userId" | "expiresAt" | "token" | "ipAddress" | "userAgent" > & { expiresIn? : number ; updateAge? : number ; disableSessionRefresh? : boolean ; deferSessionRefresh? : boolean ; storeSessionInDatabase? : boolean ; preserveSessionInDatabase? : boolean ; cookieCache? : { maxAge? : number ; enabled? : boolean ; strategy? : "jwt" | "compact" | "jwe" ; refreshCache? : | boolean | { updateAge? : ...; }; version? : string | (( session , user ) => ...) | (( session , user ) => ...); }; freshAge? : number ; }; account? : BetterAuthDBOptions < "account" , | "id" | "createdAt" | "updatedAt" | "userId" | "accountId" | "providerId" | "accessToken" | "refreshToken" | "idToken" | "accessTokenExpiresAt" | "refreshTokenExpiresAt" | "scope" | "password" > & { updateAccountOnSignIn? : boolean ; accountLinking? : { enabled? : boolean ; disableImplicitLinking? : boolean ; requireLocalEmailVerified? : boolean ; trustedProviders? : ... | (( request? ) => ...); allowDifferentEmails? : boolean ; allowUnlinkingAll? : boolean ; updateUserInfoOnLink? : boolean ; }; encryptOAuthTokens? : boolean ; skipStateCookieCheck? : boolean ; storeStateStrategy? : "database" | "cookie" ; storeAccountCookie? : boolean ; }; verification? : BetterAuthDBOptions < "verification" , "id" | "createdAt" | "updatedAt" | "expiresAt" | "identifier" | "value" > & { disableCleanup? : boolean ; storeIdentifier? : | StoreIdentifierOption | { default : StoreIdentifierOption ; overrides? : Record <..., ...>; }; storeInDatabase? : boolean ; }; trustedOrigins? : | string | (( request? ) => Awaitable <( string | null | undefined ) >); advanced? : BetterAuthAdvancedOptions ; logger? : Logger ; databaseHooks? : { user? : { create? : { before? : ... | ...; after? : ... | ...; }; update? : { before? : ... | ...; after? : ... | ...; }; delete? : { before? : ... | ...; after? : ... | ...; }; }; session? : { create? : { before? : ... | ...; after? : ... | ...; }; update? : { before? : ... | ...; after? : ... | ...; }; delete? : { before? : ... | ...; after? : ... | ...; }; }; account? : { create? : { before? : ... | ...; after? : ... | ...; }; update? : { before? : ... | ...; after? : ... | ...; }; delete? : { before? : ... | ...; after? : ... | ...; }; }; verification? : { create? : { before? : ... | ...; after? : ... | ...; }; update? : { before? : ... | ...; after? : ... | ...; }; delete? : { before? : ... | ...; after? : ... | ...; }; }; }; onAPIError? : { throw? : boolean ; onError? : ( error , ctx ) => void | Promise < void >; errorURL? : string ; customizeDefaultErrorPage? : { colors? : { background? : ... | ...; foreground? : ... | ...; primary? : ... | ...; primaryForeground? : ... | ...; mutedForeground? : ... | ...; border? : ... | ...; destructive? : ... | ...; titleBorder? : ... | ...; titleColor? : ... | ...; gridColor? : ... | ...; cardBackground? : ... | ...; cornerBorder? : ... | ...; }; size? : { radiusSm? : ... | ...; radiusMd? : ... | ...; radiusLg? : ... | ...; textSm? : ... | ...; text2xl? : ... | ...; text4xl? : ... | ...; text6xl? : ... | ...; }; font? : { defaultFamily? : ... | ...; monoFamily? : ... | ...; }; disableTitleBorder? : boolean ; disableCornerDecorations? : boolean ; disableBackgroundGrid? : boolean ; }; }; telemetry? : { enabled? : boolean ; debug? : boolean ; }; experimental? : { joins? : boolean ; instrumentation? : { enabled? : boolean ; }; }; basePath : string ; database : AdapterFactory < BetterAuthOptions >; disabledPaths : string ; emailAndPassword : { disableSignUp? : boolean ; requireEmailVerification? : boolean ; maxPasswordLength? : number ; minPasswordLength? : number ; sendResetPassword? : ( data , request? ) => Promise < void >; resetPasswordTokenExpiresIn? : number ; onPasswordReset? : ( data , request? ) => Promise < void >; password? : { hash? : ( password ) => Promise < string >; verify? : ( data ) => Promise < boolean >; }; autoSignIn? : boolean ; revokeSessionsOnPasswordReset? : boolean ; onExistingUserSignUp? : ( data , request? ) => Promise < void >; customSyntheticUser? : ( params ) => Record < string , unknown >; enabled : boolean ; }; user : { modelName? : "user" | LiteralString ; fields? : Partial < Record < "name" | "email" | "emailVerified" | "image" | "createdAt" | "updatedAt" , string >>; additionalFields? : { [ key : string ]: DBFieldAttribute ; }; changeEmail? : { enabled : boolean ; sendChangeEmailConfirmation? : ( data , request? ) => Promise < void >; updateEmailWithoutVerification? : boolean ; }; deleteUser? : { enabled? : boolean ; sendDeleteAccountVerification? : ( data , request? ) => Promise < void >; beforeDelete? : ( user , request? ) => Promise < void >; afterDelete? : ( user , request? ) => Promise < void >; deleteTokenExpiresIn? : number ; }; }; rateLimit : { window? : number ; max? : number ; modelName? : "rateLimit" | LiteralString ; fields? : Partial < Record < "key" | "count" | "lastRequest" , string >>; customRules? : { [ key : string ]: | false | BetterAuthRateLimitRule | (( request , currentRule ) => Awaitable <... | ...>); }; storage? : "memory" | "database" | "secondary-storage" ; customStorage? : BetterAuthRateLimitStorage ; enabled : boolean ; }; hooks : | { before? : MiddlewareHandler ; after? : MiddlewareHandler ; } | undefined ; plugins : [{ id : "convex" ; version : string ; init : ( ctx ) => void ; hooks : { before : ( | { matcher ( context ): boolean ; handler : ( inputContext ) => ...; } | { matcher : ( ctx ) => ...; handler : ( inputContext ) => ...; }) ; after : { matcher : ( context ) => boolean ; handler : MiddlewareHandler ; } ; }; endpoints : { getOpenIdConfig : StrictEndpoint < "/convex/.well-known/openid-configuration" , { method : "GET" ; metadata : { isAction : false ; }; }, OIDCMetadata >; getJwks : StrictEndpoint < "/convex/jwks" , { method : "GET" ; metadata : { openapi : { description : ...; responses : ...; }; }; }, JSONWebKeySet >; getLatestJwks : StrictEndpoint < "/convex/latest-jwks" , { isAction : boolean ; method : "POST" ; metadata : { SERVER_ONLY : true ; openapi : { description : ...; }; }; }, any >; rotateKeys : StrictEndpoint < "/convex/rotate-keys" , { isAction : boolean ; method : "POST" ; metadata : { SERVER_ONLY : true ; openapi : { description : ...; }; }; }, any >; getToken : StrictEndpoint < "/convex/token" , { method : "GET" ; requireHeaders : true ; use : (( inputContext ) => ...) ; metadata : { openapi : { description : ...; responses : ...; }; }; }, { token : string ; }>; }; schema : { jwks : { fields : { publicKey : { type : "string" ; required : true ; }; privateKey : { type : "string" ; required : true ; }; createdAt : { type : "date" ; required : true ; }; expiresAt : { type : "date" ; required : false ; }; }; }; user : { fields : { userId : { type : "string" ; required : false ; input : false ; }; }; }; }; }, ...(BetterAuthPlugin | { id: "email-otp"; version: string; init: any; endpoints: { sendVerificationOTP: StrictEndpoint<"/email-otp/send-verification-otp", { method: "POST"; use: (...)[]; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; createVerificationOTP: StrictEndpoint; metadata: { openapi: ... } }, string>; getVerificationOTP: StrictEndpoint; metadata: { openapi: ... } }, { otp: ... } | { otp: ... }>; checkVerificationOTP: StrictEndpoint<"/email-otp/check-verification-otp", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; verifyEmailOTP: StrictEndpoint<"/email-otp/verify-email", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { status: ...; token: ...; user: ... } | { status: ...; token: ...; user: ... }>; signInEmailOTP: StrictEndpoint<"/sign-in/email-otp", { method: "POST"; body: ZodIntersection<(...), (...)>; metadata: { openapi: ... } }, { token: string; user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... } }>; requestPasswordResetEmailOTP: StrictEndpoint<"/email-otp/request-password-reset", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; forgetPasswordEmailOTP: StrictEndpoint<"/forget-password/email-otp", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; resetPasswordEmailOTP: StrictEndpoint<"/email-otp/reset-password", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { success: boolean }>; requestEmailChangeEmailOTP: StrictEndpoint<"/email-otp/request-email-change", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; changeEmailEmailOTP: StrictEndpoint<"/email-otp/change-email", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }> }; hooks: { after: { matcher: any; handler: Middleware<(...), (...)> }[] }; rateLimit: ({ pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number } | { pathMatcher: any; window: number; max: number })[]; options: EmailOTPOptions; $ERROR_CODES: { OTP_EXPIRED: RawError<"OTP_EXPIRED">; INVALID_OTP: RawError<"INVALID_OTP">; TOO_MANY_ATTEMPTS: RawError<"TOO_MANY_ATTEMPTS"> } } | { id: "passkey"; version: string; endpoints: { generatePasskeyRegistrationOptions: StrictEndpoint<"/passkey/generate-register-options", { method: "GET"; use: (...)[]; query: ZodOptional<(...)>; metadata: { openapi: ... } }, PublicKeyCredentialCreationOptionsJSON>; generatePasskeyAuthenticationOptions: StrictEndpoint<"/passkey/generate-authenticate-options", { method: "GET"; metadata: { openapi: ... } }, PublicKeyCredentialRequestOptionsJSON>; verifyPasskeyRegistration: StrictEndpoint<"/passkey/verify-registration", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, Passkey>; verifyPasskeyAuthentication: StrictEndpoint<"/passkey/verify-authentication", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { session: { id: ...; createdAt: ...; updatedAt: ...; userId: ...; expiresAt: ...; token: ...; ipAddress?: ...; userAgent?: ... }; user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... } }>; listPasskeys: StrictEndpoint<"/passkey/list-user-passkeys", { method: "GET"; use: (...)[]; metadata: { openapi: ... } }, Passkey[]>; deletePasskey: StrictEndpoint<"/passkey/delete-passkey", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { status: boolean }>; updatePasskey: StrictEndpoint<"/passkey/update-passkey", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { passkey: Passkey }> }; schema: { passkey: { fields: { name: { type: ...; required: ... }; publicKey: { type: ...; required: ... }; userId: { type: ...; references: ...; required: ...; index: ... }; credentialID: { type: ...; required: ...; index: ... }; counter: { type: ...; required: ... }; deviceType: { type: ...; required: ... }; backedUp: { type: ...; required: ... }; transports: { type: ...; required: ... }; createdAt: { type: ...; required: ... }; aaguid: { type: ...; required: ... } } } }; $ERROR_CODES: { CHALLENGE_NOT_FOUND: RawError<"CHALLENGE_NOT_FOUND">; YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY: RawError<"YOU_ARE_NOT_ALLOWED_TO_REGISTER_THIS_PASSKEY">; FAILED_TO_VERIFY_REGISTRATION: RawError<"FAILED_TO_VERIFY_REGISTRATION">; PASSKEY_NOT_FOUND: RawError<"PASSKEY_NOT_FOUND">; AUTHENTICATION_FAILED: RawError<"AUTHENTICATION_FAILED">; UNABLE_TO_CREATE_SESSION: RawError<"UNABLE_TO_CREATE_SESSION">; FAILED_TO_UPDATE_PASSKEY: RawError<"FAILED_TO_UPDATE_PASSKEY">; PREVIOUSLY_REGISTERED: RawError<"PREVIOUSLY_REGISTERED">; REGISTRATION_CANCELLED: RawError<"REGISTRATION_CANCELLED">; AUTH_CANCELLED: RawError<"AUTH_CANCELLED">; UNKNOWN_ERROR: RawError<"UNKNOWN_ERROR">; SESSION_REQUIRED: RawError<"SESSION_REQUIRED">; RESOLVE_USER_REQUIRED: RawError<"RESOLVE_USER_REQUIRED">; RESOLVED_USER_INVALID: RawError<"RESOLVED_USER_INVALID"> }; options: PasskeyOptions | undefined } | { id: "admin"; version: string; init: any; hooks: { after: { matcher: any; handler: Middleware<(...), (...)> }[] }; endpoints: { setRole: StrictEndpoint<"/admin/set-role", { method: "POST"; body: ZodObject<(...), (...)>; requireHeaders: true; use: (...)[]; metadata: { openapi: ...; $Infer: ... } }, { user: UserWithRole }>; getUser: StrictEndpoint<"/admin/get-user", { method: "GET"; query: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, UserWithRole>; createUser: StrictEndpoint<"/admin/create-user", { method: "POST"; body: ZodObject<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { user: UserWithRole }>; adminUpdateUser: StrictEndpoint<"/admin/update-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, UserWithRole>; listUsers: StrictEndpoint<"/admin/list-users", { method: "GET"; use: (...)[]; query: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { users: (...)[]; total: number }>; listUserSessions: StrictEndpoint<"/admin/list-user-sessions", { method: "POST"; use: (...)[]; body: ZodObject<(...), (...)>; metadata: { openapi: ... } }, { sessions: (...)[] }>; unbanUser: StrictEndpoint<"/admin/unban-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { user: UserWithRole }>; banUser: StrictEndpoint<"/admin/ban-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { user: UserWithRole }>; impersonateUser: StrictEndpoint<"/admin/impersonate-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { session: { id: ...; createdAt: ...; updatedAt: ...; userId: ...; expiresAt: ...; token: ...; ipAddress?: ...; userAgent?: ... }; user: UserWithRole }>; stopImpersonating: StrictEndpoint<"/admin/stop-impersonating", { method: "POST"; requireHeaders: true }, { session: (...) & (...); user: (...) & (...) }>; revokeUserSession: StrictEndpoint<"/admin/revoke-user-session", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; revokeUserSessions: StrictEndpoint<"/admin/revoke-user-sessions", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; removeUser: StrictEndpoint<"/admin/remove-user", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { success: boolean }>; setUserPassword: StrictEndpoint<"/admin/set-user-password", { method: "POST"; body: ZodObject<(...), (...)>; use: (...)[]; metadata: { openapi: ... } }, { status: boolean }>; userHasPermission: StrictEndpoint<"/admin/has-permission", { method: "POST"; body: ZodIntersection<(...), (...)>; metadata: { openapi: ...; $Infer: ... } }, { error: null; success: boolean }> }; $ERROR_CODES: { USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL: RawError<"USER_ALREADY_EXISTS_USE_ANOTHER_EMAIL">; FAILED_TO_CREATE_USER: RawError<"FAILED_TO_CREATE_USER">; USER_ALREADY_EXISTS: RawError<"USER_ALREADY_EXISTS">; YOU_CANNOT_BAN_YOURSELF: RawError<"YOU_CANNOT_BAN_YOURSELF">; YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE: RawError<"YOU_ARE_NOT_ALLOWED_TO_CHANGE_USERS_ROLE">; YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_CREATE_USERS">; YOU_ARE_NOT_ALLOWED_TO_LIST_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS">; YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS: RawError<"YOU_ARE_NOT_ALLOWED_TO_LIST_USERS_SESSIONS">; YOU_ARE_NOT_ALLOWED_TO_BAN_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_BAN_USERS">; YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_IMPERSONATE_USERS">; YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS: RawError<"YOU_ARE_NOT_ALLOWED_TO_REVOKE_USERS_SESSIONS">; YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_DELETE_USERS">; YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_PASSWORD">; BANNED_USER: RawError<"BANNED_USER">; YOU_ARE_NOT_ALLOWED_TO_GET_USER: RawError<"YOU_ARE_NOT_ALLOWED_TO_GET_USER">; NO_DATA_TO_UPDATE: RawError<"NO_DATA_TO_UPDATE">; YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS: RawError<"YOU_ARE_NOT_ALLOWED_TO_UPDATE_USERS">; YOU_CANNOT_REMOVE_YOURSELF: RawError<"YOU_CANNOT_REMOVE_YOURSELF">; YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_NON_EXISTENT_VALUE">; YOU_CANNOT_IMPERSONATE_ADMINS: RawError<"YOU_CANNOT_IMPERSONATE_ADMINS">; INVALID_ROLE_TYPE: RawError<"INVALID_ROLE_TYPE">; YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL: RawError<"YOU_ARE_NOT_ALLOWED_TO_SET_USERS_EMAIL">; PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER: RawError<"PASSWORD_CANNOT_BE_UPDATED_VIA_UPDATE_USER"> }; schema: { user: { fields: { role: { type: ...; required: ...; input: ... }; banned: { type: ...; defaultValue: ...; required: ...; input: ... }; banReason: { type: ...; required: ...; input: ... }; banExpires: { type: ...; required: ...; input: ... } } }; session: { fields: { impersonatedBy: { type: ...; required: ...; input: ... } } } }; options: NoInfer } | DefaultOrganizationPlugin<{ allowUserToCreateOrganization?: boolean | ((user: (...) & (...)) => Awaitable<(...)>); organizationLimit?: number | ((user: (...) & (...)) => Awaitable<(...)>); creatorRole?: string; membershipLimit?: number | ((user: { id: ...; createdAt: ...; updatedAt: ...; email: ...; emailVerified: ...; name: ...; image?: ... }, organization: { id: ...; name: ...; slug: ...; logo?: ...; metadata?: ...; createdAt: ... }) => (...) | (...)); ac?: AccessControl; roles?: { [key: string]: (...) | (...) }; dynamicAccessControl?: { enabled?: (...) | (...) | (...); maximumRolesPerOrganization?: (...) | (...) | (...) }; teams?: { enabled: boolean; defaultTeam?: (...) | (...); maximumTeams?: (...) | (...) | (...); maximumMembersPerTeam?: (...) | (...) | (...); allowRemovingAllTeams?: (...) | (...) | (...) }; invitationExpiresIn?: number; invitationLimit?: number | ((data: { user: ...; organization: ...; member: ... }, ctx: AuthContext) => Awaitable<(...)>); cancelPendingInvitationsOnReInvite?: boolean; requireEmailVerificationOnInvitation?: boolean; sendInvitationEmail?: (data: { id: ...; role: ...; email: ...; organization: ...; invitation: ...; inviter: ... }, request?: (...) | (...)) => Promise<(...)>; schema?: { session?: (...) | (...); organization?: (...) | (...); member?: (...) | (...); invitation?: (...) | (...); team?: (...) | (...); teamMember?: (...) | (...); organizationRole?: (...) | (...) }; disableOrganizationDeletion?: boolean; organizationHooks?: { beforeCreateOrganization?: (...) | (...); afterCreateOrganization?: (...) | (...); beforeUpdateOrganization?: (...) | (...); afterUpdateOrganization?: (...) | (...); beforeDeleteOrganization?: (...) | (...); afterDeleteOrganization?: (...) | (...); beforeAddMember?: (...) | (...); afterAddMember?: (...) | (...); beforeRemoveMember?: (...) | (...); afterRemoveMember?: (...) | (...); beforeUpdateMemberRole?: (...) | (...); afterUpdateMemberRole?: (...) | (...); beforeCreateInvitation?: (...) | (...); afterCreateInvitation?: (...) | (...); beforeAcceptInvitation?: (...) | (...); afterAcceptInvitation?: (...) | (...); beforeRejectInvitation?: (...) | (...); afterRejectInvitation?: (...) | (...); beforeCancelInvitation?: (...) | (...); afterCancelInvitation?: (...) | (...); beforeCreateTeam?: (...) | (...); afterCreateTeam?: (...) | (...); beforeUpdateTeam?: (...) | (...); afterUpdateTeam?: (...) | (...); beforeDeleteTeam?: (...) | (...); afterDeleteTeam?: (...) | (...); beforeAddTeamMember?: (...) | (...); afterAddTeamMember?: (...) | (...); beforeRemoveTeamMember?: (...) | (...); afterRemoveTeamMember?: (...) | (...) } }>)[]]; }> - src/convex/client/index.ts
mcp McpExchange - src/convex/client/index.ts
#### Example ```ts import { setupAuth } from 'nuxt-backend/auth' import { components } from './_generated/api' import { query } from './_generated/server' import { email } from './email' export const { authComponent, createAuth, getAuthUser } = setupAuth(components, query, { email, canSignIn: async (ctx, { email }) => email.endsWith('@acme.com'), }) ``` ## Sitemap See the full [sitemap](https://nuxt-backend.dev/sitemap.md) for all pages.