Skip to main content

Authentication

Users live in auth collections. An auth collection has the system fields email, password, verified and emailVisibility; you add your own fields. Each signed-in user gets a session in the database, which you can list and revoke.

Create a users collection​

As a superuser, for example from a one-time script:

scripts/setup-auth.ts
import { NextBase } from "@nextbasejs/core";

const superuser = new NextBase().client({ superuser: true });

await superuser.collections.create({
  name: "users",
  type: "auth",
  createRule: "", // anyone can sign up
  viewRule: "id = @request.auth.id", // users see only themselves
  updateRule: "id = @request.auth.id",
  deleteRule: "id = @request.auth.id",
  fields: [{ name: "name", type: "text", required: true }],
});

A rule of "" allows anyone, null allows only superusers, and anything else is a filter the request must match.

Ways to sign in​

  • Email & Password: sign up, sign in and sign out, with optional email verification.

Account emails​

With email sending set up, users can verify their email, reset a forgotten password and change their email.

Sessions​

Every sign-in creates a session that you keep in an HttpOnly cookie or as a Bearer token. See Sessions and cookies.

Protections​

  • Passwords are hashed with scrypt.
  • Failed sign-ins are limited per account, and repeated emails per address.
  • A password reset or email change signs out every session.
  • Requests never reveal whether an email is registered.