@orionauth/account-sdk

TypeScript SDK for the OrionAuth User Account API (/api/v1/me/*). It wraps every self-service endpoint — profile, password, email change, MFA TOTP, passkeys (WebAuthn), sessions, linked accounts, account deletion — plus the step-up re-authentication flow (X-Reauth-Token) and the usernameless passkey login.

npm install @orionauth/account-sdk
# or
pnpm add @orionauth/account-sdk

Quickstart

import { AccountClient } from '@orionauth/account-sdk'

const client = new AccountClient({
  baseUrl: 'https://auth.example.com',
  getAccessToken: async () => yourAccessToken,
})

const profile = await client.profile.get()
await client.profile.update({ displayName: 'Bob' })

await client.passkeys.register({ name: 'My laptop' }) // wraps navigator.credentials.create
const sessions = await client.sessions.list()

Step-up reauthentication

Sensitive endpoints (password change, MFA disable, passkey delete, account deletion, email change, linked-account unlink) require a short-lived reauth token in X-Reauth-Token. The SDK ships two patterns:

Low-level

const { reauth_token } = await client.reauth.withPassword(currentPassword)
await client.password.change(
  { currentPassword, newPassword },
  { reauthToken: reauth_token },
)

High-level

import { withStepUp } from '@orionauth/account-sdk'

await withStepUp(
  () => client.password.change({ currentPassword, newPassword }),
  { method: 'password', getPassword: () => prompt('Confirm your password') },
)

withStepUp intercepts a ReauthRequiredError, issues a fresh reauth token and retries the original call once.

Passkeys

// 1. Enrollment (authenticated)
await client.passkeys.register({ name: 'My phone' })

// 2. Usernameless login (public, no bearer required)
import { passkeyLogin } from '@orionauth/account-sdk'

const { user_id, email } = await passkeyLogin({
  baseUrl: 'https://auth.example.com',
})

Integration with oidc-client-ts

import { UserManager } from 'oidc-client-ts'
import { fromUserManager } from '@orionauth/account-sdk/integrations/oidc-client-ts'

const userManager = new UserManager({ /* … */ })
const client = fromUserManager(userManager, {
  baseUrl: 'https://auth.example.com',
})

The helper binds getAccessToken to userManager.getUser().access_token and automatically calls signinSilent() on a 401 before retrying.

Errors

Every HTTP error throws a typed subclass of AccountError:

import {
  AccountError,
  ConflictError,
  ReauthRequiredError,
  ValidationError,
} from '@orionauth/account-sdk'

try {
  await client.email.requestChange({ newEmail: 'taken@example.com' })
} catch (err) {
  if (err instanceof ConflictError) { /* email already used */ }
  if (err instanceof ReauthRequiredError) { /* surface a reauth modal */ }
}

License

MIT