ovok.auth

Sign-in, registration, password and server-side session calls for a patient or practitioner app. These need a client created without clientSecret; a machine client throws OvokConfigError. Sign-in stores the session through the client's storage.

Sign a user inCopy Anchor Link

const result = await ovok.auth.login({ profileType: 'Practitioner', email, password });

if (result.status === 'mfa-required') {
  await ovok.auth.verifyMfa(result.challenge, codeFromAuthenticatorApp);
}

• profileType is Patient, Practitioner or RelatedPerson.
• login returns { status: 'signed-in', session } or { status: 'mfa-required', challenge }. Pass the challenge back to verifyMfa.
• Tokens come from a PKCE exchange handled for you. The tenant comes from the client's tenantCode.
• ovok.auth.current() returns the current session, or null when signed out. ovok.auth.me() fetches the profile.

RegisterCopy Anchor Link

const result = await ovok.auth.register({
  email, password, passwordConfirm: password, name: 'Ada', surname: 'Lovelace',
});

if (result.status === 'clinician-invite') {
  // no session was issued; the person must accept a clinician invitation
}

await ovok.auth.registerPractitioner({ email, password, passwordConfirm: password, name, surname });

• register creates a patient. registerPractitioner creates a practitioner and returns the Session.
• A password and confirmation that differ throw OvokValidationError before any request.

Social sign-inCopy Anchor Link

const session = await ovok.auth.socialLogin('google', googleCredential);

• Providers are apple and google. The credential comes from the provider's own SDK.
• Needs clientId in the client config; without it the call throws OvokConfigError.

Continue a sign-in made elsewhereCopy Anchor Link

const session = await ovok.auth.adoptSession({
  accessToken: earlier.accessToken,
  refreshToken: earlier.refreshToken || null,
  profile: { reference: earlier.profile.reference, display: earlier.profile.display },
});

• Use it to carry a session saved by another client, such as the legacy OvokClient, into this one. Do not write the session into storage yourself: the storage key and shape belong to the SDK.
• It begins the session as a login does: the session is stored, announced to ovok.session.onChange listeners, used on the next request and refreshed with refreshToken.
• accessToken and a profile.reference such as Patient/123 are required. refreshToken, expiresIn (seconds), project and the display names are optional.
• Omit expiresIn when the token's age is unknown: the first request then refreshes the session. Without a refreshToken the token is used until the server refuses it.
• It replaces any current session. A missing or malformed field throws OvokValidationError naming the field, and nothing is stored.

Passwords and account deletionCopy Anchor Link

await ovok.auth.changePassword({ oldPassword, newPassword });
await ovok.auth.resetPassword({ email });
await ovok.auth.completePasswordReset(body); // body from the reset email's link
await ovok.auth.deleteAccount(request);

• changePassword sends only the old and new password. Check any confirmation field in your app.
• resetPassword and completePasswordReset need no signed-in user.
• deleteAccount schedules the deletion; the user stays signed in until then.

Sessions and sign-outCopy Anchor Link

const sessions = await ovok.auth.sessions.list();
await ovok.auth.sessions.revoke('current');
await ovok.auth.logout();

• logout always clears the local session, even when the server cannot be reached.
• Revoking 'current' also ends the session on this device.

ReferenceCopy Anchor Link

• auth API reference: every method and type.
• ovok.session: saved accounts and account switching.
• Sign users in
• Errors and retries