Authenticate customers and manage sessions.
Updated
The primary login method is OTP (one-time password via email). This works for both new and existing customers:
import dash from "@/lib/dash"
// Step 1: Request OTP
await dash.auth.requestOTP("customer@example.com")
// Step 2: Customer enters the code from their email
const { customer, access_token } = await dash.auth.verifyOTP({
email: "customer@example.com",
code: "384710",
})
Customers who have set a password can also log in directly:
const { customer, access_token, refresh_token } = await dash.auth.login({
email: "customer@example.com",
password: "securePassword123!",
captcha_token: "optional_turnstile_token",
})
After login, the SDK stores tokens internally. Access tokens expire after 24 hours. The SDK handles refresh automatically, but you can also manage tokens manually:
// Check authentication state
console.log(dash.auth.isAuthenticated) // true
console.log(dash.auth.token) // "eyJ..."
console.log(dash.auth.customer) // { id, email, ... }
// Restore session from stored tokens (e.g., on page reload)
dash.auth.setToken(storedAccessToken, storedRefreshToken)
// Manually refresh an expired token
const { access_token } = await dash.auth.refreshAccessToken()
For Next.js apps, store tokens in cookies or localStorage and restore them on mount:
"use client"
import { useEffect } from "react"
import dash from "@/lib/dash"
export function AuthProvider({ children }) {
useEffect(() => {
const token = localStorage.getItem("dash_token")
const refresh = localStorage.getItem("dash_refresh")
if (token) dash.auth.setToken(token, refresh)
}, [])
return children
}
Clear the session and invalidate tokens:
await dash.auth.logout()
// Tokens are cleared, customer is null
console.log(dash.auth.isAuthenticated) // false
The SDK clears all local state including the customer object and tokens. If you stored tokens in cookies or localStorage, remove them after logout.
| Action | Method | Endpoint |
|---|---|---|
| Request OTP | POST | /storefront/auth/request-otp |
| Verify OTP | POST | /storefront/auth/verify-otp |
| Password Login | POST | /storefront/auth/login |
| Refresh Token | POST | /storefront/auth/refresh |
| Logout | POST | /storefront/auth/logout |
Before or after login, you can check if the customer or IP is banned:
const { banned, reason } = await dash.auth.checkBan()
if (banned) {
// Redirect to a banned page or show a message
console.log("Banned:", reason)
}