@usestreamline/auth

Front-end authentication utilities for Streamline apps (Dashboard, Accounts, Mobile, etc.)

Installation

npm install @usestreamline/auth

Usage

Web (Browser)

No configuration needed - works out of the box:

import { authFetch, publicFetch } from "@usestreamline/auth";

// Make authenticated requests
const res = await authFetch("/auth/session");

React Native (Mobile)

Configure the library at app startup with your cookie storage:

import { configureAuth, authFetch, saveTokensFromHeader, clearAuthCookies } from "@usestreamline/auth";
import * as SecureStore from "expo-secure-store";

// Configure once at app startup (e.g., in App.tsx or index.js)
configureAuth({
  platform: "mobile",
  origin: "https://dash.streamline.cx", // Your allowed CORS origin
  getCookie: async (name) => SecureStore.getItemAsync(`auth_${name}`),
  setCookie: async (name, value) => SecureStore.setItemAsync(`auth_${name}`, value),
  clearCookies: async () => {
    await SecureStore.deleteItemAsync("auth_refreshToken");
    await SecureStore.deleteItemAsync("auth_csrfToken");
  },
});

// After login, save the tokens from the response
const res = await authFetch("/auth/login", { method: "POST", body: ... });
if (res.ok) {
  await saveTokensFromHeader(res.headers.get("set-cookie"));
}

// On logout
await clearAuthCookies();

API

configureAuth(options)

Configure the library for your platform.

| Option | Type | Description | |--------|------|-------------| | platform | 'web' \| 'mobile' | The current platform | | origin | string | (Mobile only) The Origin header to send for CORS | | getCookie | (name: string) => Promise<string \| null> \| string \| null | Custom cookie getter | | setCookie | (name: string, value: string) => Promise<void> \| void | Custom cookie setter | | clearCookies | () => Promise<void> \| void | Clear all auth cookies |

authFetch(path, options)

Make an authenticated API request. Automatically includes:

• X-CSRF-Token header
• Cookie header (mobile) or credentials: "include" (web)
• Origin/Referer headers (mobile only)

publicFetch(path, options)

Make a public (non-authenticated) API request.

saveTokensFromHeader(header)

Parse and save tokens from a Set-Cookie header string. Call this after login on mobile.

clearAuthCookies()

Clear all stored auth cookies. Call this on logout.

getCookie(name)

Get a cookie value by name.

buildAuthHeaders(additional?)

Build headers for an authenticated request. Useful if you need to customize the request.

Breaking Changes in v2.0.0

• buildAuthHeaders() is now async (returns Promise<Headers>)
• getCookie() is now async (returns Promise<string | null>)
• New configureAuth() function required for mobile apps