API reference

import { Radon } from "@radonsdk/auth";

const auth = new Radon({
  adapter,                                  // required
  session: { secret: process.env.RADON_SECRET! }, // required
  providers: { /* enabled methods */ },
  appName: "Acme",
  code: { length: 6, ttlMs: 600_000, maxAttempts: 5 },
  rateLimit: { maxPerWindow: 3, windowMs: 600_000 },
  licenseKey: process.env.RADON_LICENSE_KEY, // Pro
  encryptionKey: process.env.RADON_ENCRYPTION_KEY, // TOTP
});

sendCode({ email, metadata? }): Promise<{ expiresAt: Date }>
verify({ email, code }): Promise<{ user: RadonUser; created: boolean }>

sendLink({ email, redirectTo?, metadata? }): Promise<{ url: string; expiresAt: Date }>
verify(signedToken): Promise<{ user: RadonUser; created: boolean }>

signup({ email, password, metadata? }): Promise<{ user: RadonUser }>
login({ email, password }): Promise<{ user: RadonUser }>
requestReset({ email, redirectTo? }): Promise<{ sent: boolean }>
setPassword({ token, newPassword }): Promise<{ user: RadonUser }>

getAuthUrl({ state?, scopes?, accessType?, prompt?, loginHint? }): string
handleCallback(code): Promise<{ user: RadonUser; created: boolean; profile: GoogleProfile }>

getAuthUrl({ state?, scopes?, params? }): { url: string; codeVerifier?: string; state?: string }
handleCallback({ code, codeVerifier? }): Promise<{ user; created; profile; tokens }>
// auth.oauthProviders → string[] of configured provider names

sendCode({ phone, metadata? }): Promise<{ expiresAt: Date }>
verify({ phone, code }): Promise<{ user: RadonUser; created: boolean }>

beginEnrollment(userId): Promise<{ secret: string; uri: string }>
confirmEnrollment(userId, code): Promise<{ recoveryCodes: string[] }>
verify(userId, code): Promise<boolean>
verifyRecoveryCode(userId, code): Promise<boolean>
isEnabled(userId): Promise<boolean>
regenerateRecoveryCodes(userId): Promise<string[]>
disable(userId): Promise<void>

startRegistration(userId): Promise<{ options; challenge: string }>
finishRegistration({ userId, response, expectedChallenge }): Promise<{ credential }>
startAuthentication(userId?): Promise<{ options; challenge: string }>
finishAuthentication({ userId?, response, expectedChallenge }): Promise<{ user: RadonUser }>
listCredentials(userId): Promise<Array<Omit<StoredCredential, "publicKey">>>
removeCredential(userId, credentialId): Promise<void>

issue({ userId, claims?, device? }): Promise<TokenPair>
refresh(refreshToken, { claims?, device? }?): Promise<TokenPair>
revoke(refreshToken): Promise<void>
revokeAllForUser(userId): Promise<void>
// TokenPair = { accessToken, accessExpiresAt, refreshToken, refreshExpiresAt, familyId }

create({ userId, device?, ttlMs? }): Promise<{ token; session }>
listDevices(userId, currentToken?): Promise<DeviceSession[]>
revokeDevice(sessionId): Promise<void>
revoke(token): Promise<void>
revokeAll(userId): Promise<void>
createGuest({ device?, metadata? }?): Promise<{ user; token; session }>
isGuest(userId): Promise<boolean>
upgrade({ userId, provider, providerAccountId, email?, emailVerified? }): Promise<{ user }>
impersonate(adminUserId, targetUserId, { expiresInSec?, reason? }?): Promise<{ token; expiresAt }>

create({ userId?, orgId?, name, scopes?, expiresAt?, metadata? }): Promise<{ key; record }>
verify(presentedKey): Promise<PublicApiKey>
list({ userId?, orgId? }): Promise<PublicApiKey[]>
revoke(apiKeyId): Promise<void>

create({ name, slug?, ownerUserId, metadata? }): Promise<{ org; membership }>
get(idOrSlug): Promise<RadonOrg | null>
listForUser(userId): Promise<RadonOrgMembership[]>
listMembers(orgId): Promise<RadonOrgMembership[]>
roleOf(orgId, userId): Promise<OrgRole | null>
invite({ orgId, email, role?, invitedByUserId? }): Promise<{ invite; token; url? }>
acceptInvite(token, userId): Promise<RadonOrgMembership>
addMember(orgId, userId, role?): Promise<RadonOrgMembership>
setRole(orgId, userId, role): Promise<RadonOrgMembership>
removeMember(orgId, userId): Promise<void>
assertRole(orgId, userId, min): Promise<void>
delete(orgId): Promise<void>

exportData(userId): Promise<UserDataExport>
deleteUser(userId): Promise<void>

import { verifyToken } from "@radonsdk/auth";

const claims = verifyToken(cookieValue, process.env.RADON_SECRET!, {
  clockToleranceSec: 0, // optional
});
// claims.sub is the user id

interface RadonUser {
  id: string;
  email: string | null;
  emailVerified: boolean;
  metadata: Record<string, unknown>;
  createdAt: Date;
  updatedAt: Date;
}

import { RateLimitError } from "@radonsdk/auth";

try {
  await auth.emailCode.sendCode({ email });
} catch (err) {
  if (err instanceof RateLimitError) {
    // err.retryAfterMs — ms until the caller can retry
  }
}