E-mail & Password

1Set it up in the Console#

1. Abrova Auth › Sign-in methods: turn on E-mail and password. Set the shortest password (8 to 128 characters, default 8) and whether users need a verified e-mail before they can sign in.
2. Abrova Auth › Settings › Link addresses: add the addresses your e-mail links may open, for example https://example.com/auth or myapp://auth. Each must be an https:// address or your app's own URL scheme.

2Sign up#

// Flutter
final result = await AbrovaAuth.instance.signUpWithEmail(
  email: email,
  password: password,
  redirectUrl: 'https://example.com/auth/verify', // optional: sends a verification e-mail
);
if (!result.signedIn) {
  // The project requires a verified e-mail: ask the user to open the link first.
}

// iOS
let result = try await AbrovaAuth.shared.signUp(email: email, password: password,
                                                redirectURL: "https://example.com/auth/verify")

// Android
val result = AbrovaAuth.shared.signUp(email, password, redirectUrl = "https://example.com/auth/verify")

// Web and React Native
const result = await auth.signUpWithEmail({ email, password, redirectUrl: 'https://example.com/auth/verify' });

The result tells you verificationSent (a verification e-mail went out) and signedIn. When Require a verified e-mail is on, the user is not signed in until they open the link and then sign in.

A password must be at least the project's shortest length, at most 128 characters, and not a very common password. Otherwise the call fails with WEAK_PASSWORD. An address that already has an account fails with EMAIL_TAKEN.

3Sign in#

A wrong password and an unknown e-mail both fail with INVALID_CREDENTIALS, so the answer never reveals who has an account. Repeated failures for one address or from one place are slowed down (RATE_LIMITED).

4Verify the e-mail#

The verification link opens <your link address>?token=... and is valid for 24 hours. Read the token and pass it to the SDK:

Verifying only marks the e-mail as verified; it does not sign the user in. To send the e-mail again for the signed-in user, call sendEmailVerification with a redirectUrl.

5Reset a forgotten password#

1. Call sendPasswordReset with the e-mail and a redirectUrl. The answer is the same whether or not the address has an account.
2. The e-mail links to <redirectUrl>?token=..., valid for 30 minutes and usable once.
3. Show a "new password" screen and call resetPassword with the token and the new password.

// Flutter
await AbrovaAuth.instance.sendPasswordReset(email, redirectUrl: 'https://example.com/auth/reset');
// ... in the screen the link opens:
await AbrovaAuth.instance.resetPassword(tokenFromLink, newPassword);

A reset ends every session of the user and marks the e-mail as verified. It does not sign the user in: they sign in with the new password.

Give an anonymous user a password#

linkPassword adds an e-mail and password to the signed-in (usually anonymous) user. The id stays the same. It fails with EMAIL_TAKEN when another user has that address.

The e-mails#

Abrova Auth sends three e-mails: verify your e-mail, reset your password and the magic link. They name your project, and are sent from Abrova's address. Sending is limited per address (a few per hour) and per project.

Errors#