> For the complete documentation index, see [llms.txt](https://docs.jetadmin.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.jetadmin.io/api-reference/javascript-sdk/authentication.md).

# Configuration and authentication

### Configure a client

```typescript
import { Jet } from '@jet-admin/jet-sdk';

const jet = new Jet({
  project: 'YOUR_PROJECT',
  environment: 'prod',
  apiBaseUrl: 'https://data.jetadmin.io',
});
```

| Option        | Type                     | Default and behavior                                                                                  |
| ------------- | ------------------------ | ----------------------------------------------------------------------------------------------------- |
| `project`     | `string`                 | No default. Supply your project identifier; the constructor does not validate it.                     |
| `environment` | `string`                 | `prod`                                                                                                |
| `apiBaseUrl`  | `string`                 | `https://data.jetadmin.io`; omit a trailing slash.                                                    |
| `draft`       | `boolean`                | Unset. When true, Axios requests include `draft=1`; agent prompts also include `draft` in their body. |
| `apiToken`    | `string`                 | Unset. Sent as `Authorization: Bearer <token>`.                                                       |
| `env`         | `Record<string, string>` | Optional environment-variable map.                                                                    |

Requests use `{apiBaseUrl}/projects/{project}/{environment}/` as their base URL.

#### Environment variables

Pass your environment map explicitly as `env`; the SDK does not read it automatically. It recognizes these pairs, preferring the `VITE_` value when present:

| Setting      | Environment keys                            |
| ------------ | ------------------------------------------- |
| Project      | `VITE_JET_PROJECT`, `JET_PROJECT`           |
| Environment  | `VITE_JET_ENVIRONMENT`, `JET_ENVIRONMENT`   |
| Draft        | `VITE_JET_DRAFT`, `JET_DRAFT`               |
| API base URL | `VITE_JET_API_BASE_URL`, `JET_API_BASE_URL` |

Explicit constructor options override values from `env`. Defined values override defaults. There is no environment-variable mapping for `apiToken`. Draft strings `false`, `0`, `no`, `off`, `null`, and `undefined` mean false, ignoring case and surrounding whitespace; an empty value is treated as unset.

### Sign users in

```typescript
import { Jet } from '@jet-admin/jet-sdk';

const jet = new Jet({ project: 'YOUR_PROJECT' });

async function signIn(email: string, password: string) {
  const { user } = await jet.auth.loginViaEmailPassword(email, password);
  return user;
}

async function currentUser() {
  const state = await jet.auth.isAuthenticated();
  return state.authenticated ? state.user : undefined;
}

async function signOut() {
  await jet.auth.logout();
}
```

Login returns `{ token: AuthState, user: UserInfo }`. The SDK stores tokens in the browser's `localStorage` under `jet_auth`, restores them when constructed, and sends access tokens with the `JWT` prefix. Before an authenticated request, it attempts refresh when either available token-expiry timestamp is less than 30 seconds away.

All clients on the same browser origin share the `jet_auth` storage key, including clients for different projects. A previously created client keeps its own in-memory state. Logging out clears that client's state and the storage entry; it does not revoke a token on the server or synchronize other clients and tabs.

`isAuthenticated()` returns `{ authenticated: false }` without an HTTP call when no headers are available. Request failures still reject the promise; catch them separately from a successful unauthenticated result.

### API tokens

`apiToken` takes the token value without a prefix. The SDK adds `Bearer` and prioritizes this option over user-session tokens. Use a token accepted by your project's SDK endpoints. A resource API documented with a raw Authorization token is not automatically compatible with this option.

Do not embed privileged API tokens in a public browser bundle. Use user authentication for browser examples. Server use requires resolving the runtime limitations below.

`logout()` does not clear a constructor's `apiToken`. To stop using it, discard the client and initialize a client without that option.

### Account methods

All methods below return promises. Availability and authorization depend on the project's authentication configuration.

| Method                                         | Arguments                                                                              | Resolved value                                                                                                                       |
| ---------------------------------------------- | -------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ |
| `registerViaEmailPassword(options)`            | Required `email`, `password`; optional `firstName`, `lastName`, `language`, `timezone` | Declared union `{ result: true, user }` or `{ result: false }`; successful implementation returns the first shape. Does not sign in. |
| `changePassword(newPassword, currentPassword)` | Pass a string or `undefined` for the second argument as required by your auth flow     | `{ result, newState }`; saves the returned tokens                                                                                    |
| `resetPassword(email)`                         | Email address                                                                          | `{ result }`                                                                                                                         |
| `resetPasswordComplete(code, newPassword)`     | Reset code and new password                                                            | `{ result, newState }`; saves the returned tokens                                                                                    |
| `changeEmail(newEmail, currentPassword)`       | New email and a string or `undefined` for the current password                         | `{ result, sentConfirmationTo }`                                                                                                     |
| `changeEmailComplete(code)`                    | Confirmation code                                                                      | `{ result, oldEmail, newEmail }`                                                                                                     |
| `getHeaders()`                                 | None                                                                                   | Authorization headers, or `undefined`                                                                                                |

`UserInfo` includes `uid`, `username`, `hasPassword`, and profile fields such as `email`, `firstName`, and `lastName`. `AuthState` contains access and refresh tokens and optional expiry dates. Avoid logging token objects.

### Service requests and server use

`Jet.fromServiceRequest(req)` reads `X-Jet-Project`, `X-Jet-Environment`, and `X-Jet-Service-Token` from `req.headers`. These three headers are required. Optional `X-Jet-API-Base-Url` and `X-Jet-Draft` are forwarded to the constructor. `jet.auth.loginViaServiceRequest(req)` only loads the service token into an existing client. Service tokens use the `JWT` prefix.

These methods still rely on `localStorage`. A request-scoped authentication/storage implementation is needed before using this version in a multi-user server. The SDK does not supply one. Also, `X-Jet-Draft` is not parsed as a boolean here: a string such as `"false"` is truthy. Only accept these configuration headers from a trusted service boundary, especially the API base URL that determines where credentials are sent.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.jetadmin.io/api-reference/javascript-sdk/authentication.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.