Email and password

Email and password is the flow every quickstart builds. This page collects the calls in one place, with what each one does to the session. The Next.js, Flutter, and JavaScript quickstarts show them in a finished app.

Sign up

account.create creates the user and signs them in. The SDK stores the new session.

JavaScript

const { user, isNewUser } = await orvano.account.create({ email, password, name })

Next.js

'use server'
// In a server action, so the SDK can set the session cookies.
await (await orvano()).account.create({ email, password, name })

Flutter

final result = await orvano.account.create(
  CreateAccountRequest(email: email, password: password, name: name),
);

• The email must be unused in the project, ignoring case; a taken one gets user_already_exists.
• The password needs 8 to 256 characters, or the call gets invalid_password.
• name is optional.
• To send a verification email in the same call, pass verificationRedirectUrl; see Email verification.

Sign in

account.createPasswordSession signs an existing user in. Each sign in opens a new session, so a user can be signed in on many devices at once.

JavaScript

const { user } = await orvano.account.createPasswordSession({ email, password })

Next.js

'use server'
await (await orvano()).account.createPasswordSession({ email, password })

Flutter

await orvano.account.createPasswordSession(
  CreatePasswordSessionRequest(email: email, password: password),
);

A wrong email and a wrong password get the same invalid_credentials, so nobody can find out which emails have accounts. A blocked user with the right password gets user_blocked. After 10 tries in 15 minutes for one email, Orvano answers rate_limited with the seconds to wait.

Sign out

account.deleteCurrentSession ends this session on Orvano and forgets it on the device. The user’s other sessions stay.

JavaScript

await orvano.account.deleteCurrentSession()

Next.js

'use server'
await (await orvano()).account.deleteCurrentSession()

Flutter

await orvano.account.deleteCurrentSession();

Change the password

account.updatePassword needs the current password, and ends every other session of the user. This session stays signed in.

JavaScript

await orvano.account.updatePassword({ currentPassword, newPassword })

Next.js

'use server'
await (await orvano()).account.updatePassword({ currentPassword, newPassword })

Flutter

await orvano.account.updatePassword(
  UpdatePasswordRequest(currentPassword: currentPassword, newPassword: newPassword),
);

A user who signed up without a password (with a magic link or an emailed code) can set one without currentPassword, but only within 10 minutes of signing in; after that the call gets reauthentication_required. For a forgotten password, see Password reset.

Delete the account

account.delete deletes the user and every session, for good. It asks for the password the same way:

JavaScript

await orvano.account.delete({ password })

Next.js

'use server'
await (await orvano()).account.delete({ password })

Flutter

await orvano.account.delete(DeleteAccountRequest(password: password));

Show the signed in user

account.get answers with the user, or throws a 401 when nobody is signed in. Each quickstart wraps it in a currentUser helper that answers null instead. account.update changes the user’s name and metadata.