Class: AuthClient
Constructors
Constructor
new AuthClient(
client,options?):AuthClient
Parameters
client
options?
AuthClientOptions = {}
Returns
AuthClient
Methods
getAddresses()
getAddresses():
Promise<MailingAddressFragment[] |null>
Saved address book of the authenticated customer (shipping + billing).
Each entry carries B2B fields (taxId, vatNumber) and the isDefault
flag, so the same list serves both pickers on checkout.
Resolves with null when the request reaches the server without an auth
context — symmetric with getCustomer() which also returns null for
the unauthenticated case. Storefront UIs typically already gate access
to address-pickers behind their own auth-state (useAuth), so null
here means "no session reached the server" rather than "no addresses".
Returns
Promise<MailingAddressFragment[] | null>
getCustomer()
getCustomer():
Promise<CustomerFieldsFragment|null>
Fetch customer data — auth context z cookie / Authorization Bearer.
Browser uses cookie auto-sent; non-browser klient passes Bearer header
via SDK auth middleware (setAuthToken).
Returns
Promise<CustomerFieldsFragment | null>
login()
login(
password):Promise<AuthResult>
Login with email and password. Returns access token + expiry.
Parameters
email
string
password
string
Returns
Promise<AuthResult>
logout()
logout():
Promise<void>
Logout — invalidates auth cookie on backend (server clears Set-Cookie via Apollo plugin).
Auth context czytany przez backend StorefrontShopGuard z httpOnly cookie lub
Authorization: Bearer header (gdy ustawione przez SDK auth middleware).
Does not throw on failure (token may already be expired).
Returns
Promise<void>
recoverSession()
recoverSession():
Promise<SessionRecoverResult|null>
Recover the session on a cold start via the idempotent whoami route
(GET {authBasePath}/whoami) WITHOUT rotating the refresh token.
On a hard reload the in-memory access token is gone (never persisted), but the
httpOnly access cookie may still be valid. This puts the token back without
spending a rotation and without hitting the refresh rate-limit — so reloading
the page repeatedly never triggers a "too many refreshes" rate-limit. Resolves
null when whoami reports no live session: the caller then falls back to
refreshSession (a rotation, which can still succeed on a live refresh
token). Throws only on a transport failure (treat as transient — never a logout).
Returns
Promise<SessionRecoverResult | null>
refreshSession()
refreshSession():
Promise<SessionRefreshResult>
Refresh the session via the same-origin BFF route (POST {authBasePath}/refresh).
This is the browser refresh path: the route handler reads the httpOnly
refresh cookie server-side, rotates it against the backend server-to-server,
sets the new first-party cookies, and returns only the new access token +
absolute expiry. The refresh token is never read by JS — so an EXPIRED access
token still refreshes (the GraphQL customerRefreshToken mutation could not,
as it required a valid access token).
Throws a StorefrontError with code SESSION_EXPIRED when the route
responds non-OK (reused/expired/missing refresh token) — the scheduler and
the reactive-401 middleware translate that into a session-expired signal.
Returns
Promise<SessionRefreshResult>
refreshToken()
refreshToken():
Promise<AuthResult>
Refresh the access token via the GraphQL customerRefreshToken mutation.
Returns
Promise<AuthResult>
Deprecated
The browser refresh now goes through refreshSession
(same-origin BFF). This GraphQL mutation requires a still-valid access token
and is retained for backward compatibility until it is removed in a future
major release. Prefer refreshSession().
register()
register(
input):Promise<AuthResult>
Register new customer account. Returns access token + customer data.
Parameters
input
Returns
Promise<AuthResult>
resendVerificationEmail()
resendVerificationEmail():
Promise<void>
Queue a fresh verification e-mail for the currently authenticated customer. Takes no arguments — the recipient comes from the session, so the call cannot probe arbitrary addresses. The e-mail is sent asynchronously (expect a small delay).
Throws a StorefrontError on rejection — read userErrors[0].code:
ALREADY_VERIFIED (address already confirmed — no e-mail sent),
TOKEN_INVALID (no customer session).
Returns
Promise<void>
verifyEmail()
verifyEmail(
token):Promise<void>
Confirm the customer's e-mail address using the raw verification token
from the verification e-mail URL (?token=…). Public — the customer may
open the link on any device without a session. Idempotent: a repeated call
after a successful verification resolves normally, so a refreshed page can
keep showing the success state.
Throws a StorefrontError on rejection — read userErrors[0].code:
TOKEN_EXPIRED (offer resendVerificationEmail as the CTA),
TOKEN_INVALID, TOKEN_USED.
Parameters
token
string
Returns
Promise<void>