# ovok.auth

Canonical page: https://docs.ovok.com/web-sdk/core/namespaces/auth

Sign-in, registration, password and server-side session calls for a patient or practitioner app. These need a client created without `clientSecret`; a machine client throws `OvokConfigError`. Sign-in stores the session through the client's `storage`.

## Sign a user in [#sign-a-user-in]

```ts
const result = await ovok.auth.login({ profileType: 'Practitioner', email, password });

if (result.status === 'mfa-required') {
  await ovok.auth.verifyMfa(result.challenge, codeFromAuthenticatorApp);
}
```

- `profileType` is `Patient`, `Practitioner` or `RelatedPerson`.
- `login` returns `{ status: 'signed-in', session }` or `{ status: 'mfa-required', challenge }`. Pass the challenge back to `verifyMfa`.
- Tokens come from a PKCE exchange handled for you. The tenant comes from the client's `tenantCode`.
- `ovok.auth.current()` returns the current session, or `null` when signed out. `ovok.auth.me()` fetches the profile.

## Register [#register]

```ts
const result = await ovok.auth.register({
  email, password, passwordConfirm: password, name: 'Ada', surname: 'Lovelace',
});

if (result.status === 'clinician-invite') {
  // no session was issued; the person must accept a clinician invitation
}

await ovok.auth.registerPractitioner({ email, password, passwordConfirm: password, name, surname });
```

- `register` creates a patient. `registerPractitioner` creates a practitioner and returns the `Session`.
- A password and confirmation that differ throw `OvokValidationError` before any request.

## Social sign-in [#social-sign-in]

```ts
const session = await ovok.auth.socialLogin('google', googleCredential);
```

- Providers are `apple` and `google`. The credential comes from the provider's own SDK.
- Needs `clientId` in the client config; without it the call throws `OvokConfigError`.

## Continue a sign-in made elsewhere [#continue-a-sign-in-made-elsewhere]

```ts
const session = await ovok.auth.adoptSession({
  accessToken: earlier.accessToken,
  refreshToken: earlier.refreshToken || null,
  profile: { reference: earlier.profile.reference, display: earlier.profile.display },
});
```

- Use it to carry a session saved by another client, such as the legacy `OvokClient`, into this one. Do not write the session into storage yourself: the storage key and shape belong to the SDK.
- It begins the session as a login does: the session is stored, announced to `ovok.session.onChange` listeners, used on the next request and refreshed with `refreshToken`.
- `accessToken` and a `profile.reference` such as `Patient/123` are required. `refreshToken`, `expiresIn` (seconds), `project` and the `display` names are optional.
- Omit `expiresIn` when the token's age is unknown: the first request then refreshes the session. Without a `refreshToken` the token is used until the server refuses it.
- It replaces any current session. A missing or malformed field throws `OvokValidationError` naming the field, and nothing is stored.

## Passwords and account deletion [#passwords-and-account-deletion]

```ts
await ovok.auth.changePassword({ oldPassword, newPassword });
await ovok.auth.resetPassword({ email });
await ovok.auth.completePasswordReset(body); // body from the reset email's link
await ovok.auth.deleteAccount(request);
```

- `changePassword` sends only the old and new password. Check any confirmation field in your app.
- `resetPassword` and `completePasswordReset` need no signed-in user.
- `deleteAccount` schedules the deletion; the user stays signed in until then.

## Sessions and sign-out [#sessions-and-sign-out]

```ts
const sessions = await ovok.auth.sessions.list();
await ovok.auth.sessions.revoke('current');
await ovok.auth.logout();
```

- `logout` always clears the local session, even when the server cannot be reached.
- Revoking `'current'` also ends the session on this device.

## Reference [#reference]

- [auth API reference](/web-sdk/core/reference/core/auth): every method and type.
- [ovok.session](/web-sdk/core/namespaces/session): saved accounts and account switching.
- [Sign users in](/web-sdk/core/guides/sign-in)
- [Errors and retries](/web-sdk/core/errors-and-retries)