Auth quickstart

Enable Auth, sign a user up, sign in, read the user, sign out.

From nothing to a signed-in user. Every call below is real; substitute your project id and public key.

1. Enable Auth

In the console, open your project → Auth → Enable Flares Auth.

2. Copy your public key

API keys → create a public key. Frontends use this one; it can sign users up and in, and can never administer them. About keys →

3. Sign a user up

const BASE = `https://cloud.flaresinc.com/v1/projects/${PROJECT_ID}/auth`;
const auth = { 'Authorization': `Bearer ${PUBLIC_KEY}`, 'Content-Type': 'application/json' };

const session = await fetch(`${BASE}/signup`, {
  method: 'POST', headers: auth,
  body: JSON.stringify({ email: 'aisha@example.com', password: 'a-strong-passphrase' })
}).then(r => r.json());

// { user, access_token, expires_in, refresh_token }

4. Sign in

const session = await fetch(`${BASE}/signin`, {
  method: 'POST', headers: auth,
  body: JSON.stringify({ email, password })
}).then(r => r.json());

Store refresh_token where your platform keeps secrets; keep access_token in memory.

5. Read the current user

const { user } = await fetch(`${BASE}/user`, {
  headers: { ...auth, 'X-Flares-User-Token': session.access_token }
}).then(r => r.json());

6. Refresh before the token expires

const next = await fetch(`${BASE}/refresh`, {
  method: 'POST', headers: auth,
  body: JSON.stringify({ refresh_token: stored })
}).then(r => r.json());
// next.refresh_token REPLACES the old one — see Sessions & tokens

7. Sign out

await fetch(`${BASE}/signout`, { method: 'POST', headers: auth,
  body: JSON.stringify({ refresh_token: stored }) });

Verification and password reset — configure your app's landing pages first.
Use the token with Basket so rules see auth.user.id.
Sessions and tokens — rotation, revocation, expiry.