Sign users in

This guide uses the ovok client from Get started. Pass a persistent storage when users should stay signed in across app restarts.

Sign in and outCopy Anchor Link

const result = await ovok.auth.login({
  profileType: 'Practitioner',
  email: 'ada@example.com',
  password,
});

if (result.status === 'mfa-required') {
  await ovok.auth.verifyMfa(result.challenge, codeFromAuthenticatorApp);
}

await ovok.auth.logout();

• Login flow: login runs the tenant login with PKCE and signs in to the configured tenantCode. profileType is Patient, Practitioner or RelatedPerson.
• Session storage: the session is saved in storage under ovok:<tenantCode>:session. The client never clears other keys.
• Refresh: access tokens refresh a minute before they expire.
  • A refused refresh token signs the user out and calls onUnauthenticated.
  • An outage keeps the session, so a later call can retry.
• Logout: logout always clears the local session, even when the server cannot be reached.

Saved accounts and session changesCopy Anchor Link

The client keeps a private saved session for each signed-in profile in the configured storage. ovok.session.savedAccounts.list() returns profile and project metadata without tokens. Switch or remove an account by its profile reference. Removing the active account switches to the next available saved account, when one exists:

const accounts = await ovok.session.savedAccounts.list();
await ovok.session.savedAccounts.switch('Patient/123');
await ovok.session.savedAccounts.remove('Patient/123');

Listen for sign-in, sign-out, account switches and rejected refresh tokens with ovok.session.onChange(listener). The listener receives the active Session or null; call the returned function to unsubscribe. ovok.session.current() reads the restored session snapshot. ovok.invites.accept(body) sends a record-share invite to the practitioner route or a care invite to the patient route based on the active profile.

Sign in a server as a machine clientCopy Anchor Link

On a server, pass clientId and clientSecret from a client application. The client fetches its own token from /oauth2/token and renews it before it expires. A machine client cannot call ovok.auth.login.

const ovok = new Ovok({
  baseUrl: process.env.OVOK_BASE_URL,
  tenantCode: process.env.OVOK_TENANT_CODE,
  clientId: process.env.OVOK_CLIENT_ID,
  clientSecret: process.env.OVOK_CLIENT_SECRET,
});

RelatedCopy Anchor Link

• ovok.auth and ovok.session guides.
• Errors and retries for refused sign-ins and expired sessions.