Email & Password — BolkAuth

Email/password auth is handled by @bolkauth/core and exposed through the route handler mounted at /api/auth.

Configuration

export const auth = createBolkAuth({
  adapter,
  secret: process.env.BOLKAUTH_SECRET!,
  emailAndPassword: {
    enabled: true,
    minPasswordLength: 8,
  },
});

POST /api/auth/sign-up

{
  "email": "user@example.com",
  "password": "correct-horse-battery",
  "name": "Ada Lovelace"
}

On success, BolkAuth creates the user, creates a session, and sets the session cookie.

POST /api/auth/sign-in/email

{
  "email": "user@example.com",
  "password": "correct-horse-battery"
}

Invalid credentials return an invalid_credentials error without revealing whether the email exists.

React Hooks

"use client";
 
import { useSignIn, useSignUp } from "@bolkauth/react";
 
export function AuthForms() {
  const signIn = useSignIn();
  const signUp = useSignUp();
 
  async function createAccount() {
    const result = await signUp.signUp({
      email: "user@example.com",
      password: "correct-horse-battery",
      name: "Ada Lovelace",
    });
 
    if (result.error) {
      console.error(result.error.message);
    }
  }
 
  async function logIn() {
    const result = await signIn.signIn({
      email: "user@example.com",
      password: "correct-horse-battery",
    });
 
    if (result.error) {
      console.error(result.error.message);
    }
  }
 
  return null;
}

Password Storage

BolkAuth hashes passwords using Web Crypto PBKDF2 before storing them through the adapter. The database stores only the hashed password value, never the plain text password.

Common Errors

Code	Cause
`invalid_email`	Email is missing or not in a valid format.
`weak_password`	Password is shorter than `minPasswordLength`.
`user_exists`	A sign-up request used an email that already exists.
`invalid_credentials`	Sign-in email/password did not match an account.

Configuration

Sign Up

Sign In

React Hooks

Password Storage

Common Errors

On this page