Authenticated Session

1. Customer authenticates (login | verifyOtp | register)
   ↓
2. Backend returns session.access_token (JWT) + refresh_token
   ↓
3. Storefront stores access_token (localStorage / httpOnly cookie)
   ↓
4. Every customer-scoped API call (cart, wishlist, customers, messaging, gift-cards)
   passes the access_token as xAuthToken
   ↓
5. When token nears expiry → refreshToken → swap stored access_token
   ↓
6. Customer logs out → clear stored tokens

const { user, customer, session, is_multi_store_customer } = await client.authentication.register({
  requestBody: {
    email: '[email protected]',
    password: 'securePassword123',
    name: 'Jane Doe',          // optional
    phone: '+12125550142',     // optional
    marketing_consent: true    // optional — they opted in to marketing
  }
});

if (is_multi_store_customer) {
  console.log('Linked existing Tybrite identity to this store');
} else {
  console.log('Created a brand-new login identity');
}

const { message, user, customer, session } = await client.authentication.login({
  requestBody: {
    email: '[email protected]',
    password: 'securePassword123'
  }
});

// Persist for subsequent customer-scoped calls
localStorage.setItem('tybrite_access_token', session.access_token);
localStorage.setItem('tybrite_refresh_token', session.refresh_token);

{
  "access_token": "eyJhbGciOi...",
  "refresh_token": "v1.MROK...",
  "expires_in": 3600,
  "expires_at": 1747700000
}

await client.authentication.logout();
// → { message: 'Logout successful' }

// Then clear local storage
localStorage.removeItem('tybrite_access_token');
localStorage.removeItem('tybrite_refresh_token');

const { message } = await client.authentication.sendMagicLink({
  requestBody: {
    email: '[email protected]'
  }
});
// message → "Check your email for the magic link / OTP"

const { user, customer, session } = await client.authentication.verifyOtp({
  requestBody: {
    email: '[email protected]',
    token: '123456' // The 6-digit code from email
  }
});
// → same shape as login: { message, user, customer, session }
//   session.access_token is the JWT you pass as xAuthToken thereafter

await client.authentication.resetPassword({
  requestBody: {
    email: '[email protected]',
    redirect_to: 'https://shop.example.com/reset-callback' // optional
  }
});
// → { message: 'Password reset email sent', email: '[email protected]' }

const token = localStorage.getItem('tybrite_access_token')!;

await client.authentication.updatePassword({
  xAuthToken: token,
  requestBody: {
    password: 'newSecurePassword456'
  }
});
// → {
//     message: 'Password updated successfully',
//     user: { id: 'df648f68-39b3-4ba6-9be2-ff0a9393c02b', email: '[email protected]' }
//   }

const { session } = await client.authentication.refreshToken({
  requestBody: {
    refresh_token: localStorage.getItem('tybrite_refresh_token')!
  }
});
// → { message: 'Token refreshed successfully', session: {
//       access_token: 'eyJ...<redacted>.signature',
//       refresh_token: 'v1.MROK...<redacted>',  // rotated — supersedes the old one
//       expires_in: 3600,
//       expires_at: 1781966861
//   } }

localStorage.setItem('tybrite_access_token', session.access_token);
localStorage.setItem('tybrite_refresh_token', session.refresh_token);

const token = localStorage.getItem('tybrite_access_token')!;

const { user, customer } = await client.authentication.getCurrentUser({
  xAuthToken: token
});

console.log(`Logged in as: ${user.email} (customer id: ${customer.id})`);

import { Tybrite } from '@tybrite-labs/sdk';

const client = new Tybrite({ apiKey: process.env.TYBRITE_PUBLISHABLE_KEY });

// 1. LOGIN — mint the session
const { customer, session } = await client.authentication.login({
  requestBody: {
    email: '[email protected]',
    password: 'securePassword123'
  }
});
// → { message: 'Login successful', user, customer, session }

const token = session.access_token;

// 2. CART — customer-scoped operations carry xAuthToken
await client.cartWishlist.addToCart({
  xAuthToken: token,
  requestBody: {
    customer_id: customer.id,
    variant_id: '9a47e047-b1b6-4c35-9617-820629e22e04', // Sony WH-1000XM4 default variant
    quantity: 2
  }
});
// → { items: [ { product_name, variant_name, quantity, unit_price, total_price, ... } ] }

// 3. CHECKOUT — order creation is sk-only + idempotent + HMAC-signed
//    (uses your server-side secret key, not the customer JWT)
const order = await serverClient.orders.createOrder({
  idempotencyKey: crypto.randomUUID(),
  xTimestamp: timestamp,
  xSignature: signature,
  requestBody: { customer_id: customer.id, items: [...] }
});
// → { data: { id, order_number, payment_status: 'paid', total, ... } }

// 4. REFRESH — if the access_token is near expiry
const { session: refreshed } = await client.authentication.refreshToken({
  requestBody: { refresh_token: session.refresh_token }
});
// → { message: 'Token refreshed successfully', session: { access_token, refresh_token, ... } }

// 5. LOGOUT — revoke tokens server-side
await client.authentication.logout();
// → { message: 'Logout successful' }