Admin SDK (server) — Abrova Auth

Abrova Auth for your server, with the Firebase Admin SDK's names: setCustomUserClaims, getUser and revokeRefreshTokens. The @abrova/auth-admin package for Node.js, or the same calls as plain HTTPS requests from any language.

For your server only.

The Admin SDK manages your app's users from your own server: their custom claims, their account details and their sessions. It uses the project's server secret, so it never runs in an app or a browser. Apps sign users in with the Abrova Auth SDKs.

Step 1: Installation#

The package comes from Abrova Center. Point the @abrova scope at the Abrova registry in your project's .npmrc:

.npmrcINI

@abrova:registry=https://center.abrova.ir/api/packages/abrova/npm/

bash

npm install @abrova/auth-admin

It needs Node.js 18 or later and has no dependencies.

Step 2: Initialization#

Set three environment variables on your server. You find them in the Console under Project settings:

Variable	Value
ABROVA_PROJECT_ID	The project id.
ABROVA_API_KEY	The public API key (ab_live_...).
ABROVA_SERVER_SECRET	The server secret (ab_srv_...). Server only.

import { initAdmin } from '@abrova/auth-admin';

const auth = initAdmin();

You can also pass them in code: initAdmin({ projectId, apiKey, serverSecret }).

setCustomUserClaims#

Replaces all of a user's custom claims. null or {} removes them. See Custom claims for what a claim can hold.

await auth.setCustomUserClaims(userId, { plan: 'pro', teams: ['red'] });

getUser#

Returns the user, with Firebase's UserRecord names:

const user = await auth.getUser(userId);

Field	What it is
uid	The user id (ru_...).
email, emailVerified	The e-mail address, when the user has one, and whether it is confirmed.
phoneNumber	The phone number of a Telegram sign-in, or null.
displayName	The name from Apple or Google sign-in, or null.
disabled	True when the user is disabled in the Console.
providerData	The linked sign-in methods, for example [{ providerId: "google" }]. Empty for an anonymous user.
metadata	creationTime, lastSignInTime and lastRefreshTime (the last session renewal).
customClaims	The custom claims, {} when none.
tokensValidAfterTime	The last time all of the user's sessions were ended, or null.
anonymous	True for an anonymous user.

revokeRefreshTokens#

Ends every session of the user, on every device: no renewal works any more, so the user signs in again. Access tokens already issued keep working until they expire, at most one hour later.

await auth.revokeRefreshTokens(userId);

Errors#

Every error is an AbrovaAuthAdminError with a code and the HTTP status:

Code	HTTP	Meaning
INVALID_CLAIMS	400	The claims break a rule. The message names the first problem, for example "claims.sub: not an allowed name".
USER_NOT_FOUND	404	No such user in this project.
UNAUTHENTICATED	401	Wrong API key or server secret, a key of another project, or an address your project's IP allow-list does not allow.
RATE_LIMITED	429	Too many calls in a minute. Wait and try again.
NETWORK	-	Abrova Auth could not be reached.

Without Node.js: the REST API#

Every call is one HTTPS request to https://auth-users.abrova.ir with two headers, x-api-key and x-server-secret:

Call	Request
setCustomUserClaims	PUT /v1/projects/{projectId}/users/{userId}/custom-claims with the body { "claims": { ... } }
getUser	GET /v1/projects/{projectId}/users/{userId}
revokeRefreshTokens	POST /v1/projects/{projectId}/users/{userId}/revoke-refresh-tokens

php

// PHP (Laravel)
Http::withHeaders([
    'x-api-key' => env('ABROVA_API_KEY'),
    'x-server-secret' => env('ABROVA_SERVER_SECRET'),
])->put("https://auth-users.abrova.ir/v1/projects/{$projectId}/users/{$userId}/custom-claims", [
    'claims' => ['plan' => 'pro'],
]);

Errors come back as JSON with the same code and a message.