Released 2026-06-28. End-user auth gets one-call flows + user types, so a signup/login/reset page is a few lines of server code.
Added
- One-call auth flows. In playground server code,
ctx.authnow haslogin(identifier, password, { type? }),signup(fields, { type?, autoLogin? }),changePassword(rowId, oldPassword, newPassword),requestPasswordReset(identifier),resetPassword(identifier, code, newPassword), andlogout(). They compose the existing primitives with the safe defaults baked in — rate-limiting, generic "invalid username or password" failures (no account enumeration), password hashing, and session cookies. The lower-level primitives stay for custom flows. - User types. Point End-user auth at a select column for the user's role, and
login(…, { type })separates admin from customer on a single user table. - OTP password reset.
requestPasswordResetmints a 6-digit code, stores its hash + a 10-minute expiry on the row, and returns the code to your server code so you deliver it (email/SMS via your own integration);resetPasswordverifies it (single-use) and sets the new password. Configure an OTP column (hashed) + an OTP-expiry column + an optional reset page in Auth settings.
Notes
- Login matches the username/login column (an encrypted email column can't be searched). The reset code is for your server code only — never return it to the browser.