Overview & Quick Start

Abrova Auth signs in your app's users without a backend of your own. Your app calls the SDK with its public API key; Abrova checks the credentials, keeps the session and gives the app a user token. That token is the Abrova user token: Abrova Trace can attach the signed-in user to errors today, and Sync, Chat, Push, Storage and A/B Testing will accept the same token when they launch, so their security rules know who the user is (auth.uid) without a server of yours minting anything.

Using an AI assistant? Give it this page with Copy page for AI, or all the docs as plain text from /docs/llms.txt. See AI assistants.

Available SDKs#

Every package comes from Abrova Center (center.abrova.ir); the iOS SDK installs with Swift Package Manager from GitHub.

All five SDKs have the same calls under platform-style names. Abrova Auth is for apps: there is no server SDK, and none is needed.

1Turn on Abrova Auth#

1. In Abrova Console, open your project's Settings › Products and turn on Abrova Auth.
2. Open Abrova Auth › Sign-in methods and turn on the methods your app offers: anonymous, e-mail and password, magic link, Telegram code, Apple, Google. Every method is off until you turn it on.
3. For Apple and Google, add your app's identifiers on the same page. For e-mail links, add your link addresses under Abrova Auth › Settings. For Telegram, connect your bot. Each method's page says what it needs.

2Keys#

Abrova Auth needs only your project's public API key (ab_live_...), shown under Abrova Auth › Setup. It is safe in an app: it names the project, and it cannot act as any user.

The SDK keeps both tokens for you. You never handle the refresh token yourself.

3Install and sign in#

The shortest path is an anonymous user: no screen, one call. Turn on Anonymous in the Console first.

Add the package with the Abrova registry as its source:

dependencies:
abrova_auth:
  hosted: https://center.abrova.ir/api/packages/abrova/pub
  version: ^0.1.1

Then run flutter pub get and sign in:

import 'package:abrova_auth/abrova_auth.dart';

final auth = await AbrovaAuth.initialize('ab_live_your_api_key');

auth.authStateChanges.listen((user) {
  // null when signed out
});

if (auth.currentUser == null) {
  await auth.signInAnonymously();
}
print(auth.currentUser?.id); // ru_...

The user gets a stable id and a user token from the first launch. Later, link a method to the same user — their data stays theirs:

await auth.linkPassword(email: 'sara@example.com', password: password);

The same on the web, after pointing the @abrova scope at Abrova Center in .npmrc:

@abrova:registry=https://center.abrova.ir/api/packages/abrova/npm/

import { createAbrovaAuth } from '@abrova/auth-web';

const auth = createAbrovaAuth({ apiKey: 'ab_live_your_api_key' });
await auth.ready();
if (!auth.isSignedIn) await auth.signInAnonymously();
console.log(auth.currentUserId); // ru_...

Every platform's page has the full setup: Flutter, iOS, Android, Web, React Native.

4Use the user in other Abrova products#

Today, give the user id to Abrova Trace, so errors show which user they happened to:

AbrovaTrace.setUserId(auth.currentUser!.id);

The other Abrova SDKs will ask the token provider for a token when they need one, and the Auth SDK renews it before it expires.

await AbrovaSync.init(AbrovaSyncConfig(
  apiKey: 'ab_live_your_api_key',
  tokenProvider: AbrovaAuth.instance.tokenProvider,
));

Sync security rules will then see the signed-in user as auth.uid. See Use with other Abrova products for every product and platform.

How it works#

1. 1The app signs inThe SDK sends the credential (an e-mail and password, a code, an Apple or Google ID token) with your public key.
2. 2Abrova Auth checks itAgainst your project only: its methods, its Apple and Google app ids, its users.
3. 3The app gets a sessionA 1-hour access token (the Abrova user token) and a refresh token the SDK stores securely.
4. 4Abrova products trust itEach product verifies the token and reads the user id from it.

Pricing#

Abrova Auth is paid by monthly active users: each user who signs in or renews a session in a calendar month counts once that month, however often they use the app. There are no plans: you pay from a prepaid Toman wallet for what you use above the free allowance.

When the wallet is empty and the free 1,000 are used up, new users of the month wait (MAU_LIMIT); users already counted keep signing in. See Monthly active users & limits and the pricing page. For daily active and returning users, turn on Usage insights.

Common mistakes#

• The method is not turned on. Every sign-in method starts off. A call to a method that is off fails with METHOD_DISABLED. Call getMethods() and show only the buttons it returns.
• Abrova Auth is not turned on for the project. Calls fail with PRODUCT_DISABLED until you turn it on under Settings › Products.
• Only Apple or Google is offered. Some users in Iran cannot reach Apple or Google. Offer anonymous, e-mail, magic link or Telegram code too.
• Apple or Google says the ID token is invalid. Your bundle ID, Services ID or Google client ID is missing in the Console, or the nonce you gave the provider is not the SHA-256 of the raw nonce you gave Abrova. See Sign in with Apple and Sign in with Google.
• E-mail links are refused. The redirectUrl must start with one of the link addresses in Abrova Auth › Settings.
• Signing in a second time on every start. The SDK restores the saved session at start. Check for a current user before you sign in again, or each start creates a new anonymous user.
• Using currentUser before the session is restored. On the web and React Native, wait for ready() (or the first auth state callback) after a reload.