@synonymdev/pubky
    Preparing search index...

    Class AuthFlow

    Start and control a pubkyauth authorization flow.

    Typical flow:

    1. AuthFlow.start(...) or pubky.startCookieAuthFlow(...)
    2. Show authorizationUrl() as QR/deeplink to the user’s signing device
    3. awaitApproval() to receive a ready Session

    Use GrantAuthFlow instead.

    Index
    authorizationUrl
    [dispose] awaitApproval awaitToken free tryPollOnce resume start
    authorizationUrl: string

    Return the authorization deep link (URL) to show as QR or open on the signer device.

    Security: This URL contains the client_secret in plaintext. Treat it as a short-lived secret and delete it after the flow completes. See Pubky.startCookieAuthFlow() docs for storage guidance.

    A pubkyauth://… or https://… URL with channel info.

    renderQr(flow.authorizationUrl);

    • Returns void

    • Block until the user approves on their signer device; returns a Session.

      Returns Promise<Session>

      Resolves when approved; rejects on timeout/cancel/network errors.

      • RequestError if relay/network fails
      • AuthenticationError if approval is denied/invalid

    • Block until the user approves on their signer device; returns an AuthToken.

      Returns Promise<AuthToken>

      Resolves when approved; rejects on timeout/cancel/network errors.

      • RequestError if relay/network fails

    • Returns void

    • Non-blocking single poll step (advanced UIs).

      Returns Promise<Session | undefined>

      A session if the approval arrived, otherwise undefined.

    • Resume a previously started auth flow from its saved authorizationUrl (standalone). Prefer pubky.resumeCookieAuthFlow() to reuse a facade client; this creates a default (mainnet) client.

      Relay messages expire after ~5 minutes; resume is only viable in that window. See Pubky.resumeCookieAuthFlow() / Pubky.startCookieAuthFlow() for full guidance.

      Security: authorizationUrl contains the client_secret. Delete it from storage as soon as resume completes or is abandoned.

      Parameters

      • authorization_url: string

      Returns AuthFlow

      A flow reconnected to the original relay channel.

      • { name: "AuthenticationError" } if the URL is invalid or not a signin/signup link

    • Start a flow (standalone). Prefer pubky.startCookieAuthFlow() to reuse a facade client.

      Parameters

      • capabilities: Capabilities

        Comma-separated capabilities, e.g. "/pub/app/:rw,/priv/foo.txt:r". Each entry must be "<scope>:<actions>", where:

        • scope starts with / (e.g. /pub/example.com/)
        • actions is any combo of r and/or w (order is normalized; wr -> rw) Empty string is allowed (no scopes).
      • kind: AuthFlowKind

        The kind of authentication flow to perform. This can either be a sign in or a sign up flow. Examples:

        • AuthFlowKind.signin() - Sign in to an existing account.
        • AuthFlowKind.signup(homeserverPublicKey, signupToken) - Sign up for a new account.
      • Optionalrelay: string | null

        Optional HTTP relay base, e.g. "https://demo.httprelay.io/inbox/". Defaults to the default Synonym-hosted relay when omitted.

      • Optionalx_callback: XCallbackParams | null

      Returns AuthFlow

      A running auth flow. Call authorizationUrl() to show the deep link, then awaitApproval() to receive a Session.

      • { name: "InvalidInput", message: string } if any capability entry is invalid or for an invalid relay URL.
      const flow = AuthFlow.start("/pub/my-cool-app/:rw,/pub/pubky.app/:w");
      renderQRCode(flow.authorizationUrl());
      const session = await flow.awaitApproval();

      Use GrantAuthFlow.start(...) instead.

    Settings

    On This Page
    Properties
    Methods