[{"data":1,"prerenderedAt":630},["ShallowReactive",2],{"navigation_docs":3,"-guide-authentication":55,"-guide-authentication-surround":625},[4,25],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting Started",false,"\u002Fgetting-started","1.getting-started",[10,15,20],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":21,"path":22,"stem":23,"icon":24},"Local Postgres & PostgREST","\u002Fgetting-started\u002Flocal-postgrest","1.getting-started\u002F3.local-postgrest","i-simple-icons-docker",{"title":26,"icon":6,"path":27,"stem":28,"children":29,"page":6},"Guide","\u002Fguide","2.guide",[30,35,40,45,50],{"title":31,"path":32,"stem":33,"icon":34},"Configuration","\u002Fguide\u002Fconfiguration","2.guide\u002F1.configuration","i-lucide-settings",{"title":36,"path":37,"stem":38,"icon":39},"Composables","\u002Fguide\u002Fcomposables","2.guide\u002F2.composables","i-lucide-code",{"title":41,"path":42,"stem":43,"icon":44},"Authentication","\u002Fguide\u002Fauthentication","2.guide\u002F3.authentication","i-lucide-key-round",{"title":46,"path":47,"stem":48,"icon":49},"Types","\u002Fguide\u002Ftypes","2.guide\u002F4.types","i-lucide-braces",{"title":51,"path":52,"stem":53,"icon":54},"Coming from Supabase","\u002Fguide\u002Fmigrating-from-supabase","2.guide\u002F5.migrating-from-supabase","i-lucide-arrow-right-left",{"id":56,"title":41,"body":57,"description":618,"extension":619,"links":620,"meta":621,"navigation":622,"path":42,"seo":623,"stem":43,"__hash__":624},"docs\u002F2.guide\u002F3.authentication.md",{"type":58,"value":59,"toc":612},"minimark",[60,69,74,95,308,311,364,372,375,436,440,450,489,575,579,593,597,608],[61,62,63,64,68],"p",{},"PostgREST authorizes each request with a JWT: its ",[65,66,67],"code",{},"role"," claim picks the Postgres role and its other claims are readable in RLS policies. Nuxt PostgREST's job is getting the right JWT onto each request.",[70,71,73],"h2",{"id":72},"with-nuxt-auth-utils","With nuxt-auth-utils",[61,75,76,77,86,87,90,91,94],{},"If ",[78,79,83],"a",{"href":80,"rel":81},"https:\u002F\u002Fgithub.com\u002Fatinux\u002Fnuxt-auth-utils",[82],"nofollow",[65,84,85],{},"nuxt-auth-utils"," is installed, it's detected automatically — no config needed. After your login flow mints a PostgREST JWT, store it in the session under ",[65,88,89],{},"postgrest_token"," (configurable with ",[65,92,93],{},"tokenKey","):",[96,97,103],"pre",{"className":98,"code":99,"filename":100,"language":101,"meta":102,"style":102},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","export default defineEventHandler(async (event) => {\n  \u002F\u002F ...verify credentials, then sign a JWT with your PGRST_JWT_SECRET\n  const token = await signPostgrestJwt({ role: 'authenticated', sub: user.id })\n\n  await setUserSession(event, {\n    user: { id: user.id, name: user.name },\n    postgrest_token: token,\n  })\n})\n","server\u002Fapi\u002Flogin.post.ts","ts","",[65,104,105,146,153,216,223,240,279,292,300],{"__ignoreMap":102},[106,107,110,114,117,121,125,129,133,137,140,143],"span",{"class":108,"line":109},"line",1,[106,111,113],{"class":112},"s7zQu","export",[106,115,116],{"class":112}," default",[106,118,120],{"class":119},"s2Zo4"," defineEventHandler",[106,122,124],{"class":123},"sTEyZ","(",[106,126,128],{"class":127},"spNyl","async",[106,130,132],{"class":131},"sMK4o"," (",[106,134,136],{"class":135},"sHdIc","event",[106,138,139],{"class":131},")",[106,141,142],{"class":127}," =>",[106,144,145],{"class":131}," {\n",[106,147,149],{"class":108,"line":148},2,[106,150,152],{"class":151},"sHwdD","  \u002F\u002F ...verify credentials, then sign a JWT with your PGRST_JWT_SECRET\n",[106,154,156,159,162,165,168,171,174,177,180,183,186,190,193,196,199,201,204,207,210,213],{"class":108,"line":155},3,[106,157,158],{"class":127},"  const",[106,160,161],{"class":123}," token",[106,163,164],{"class":131}," =",[106,166,167],{"class":112}," await",[106,169,170],{"class":119}," signPostgrestJwt",[106,172,124],{"class":173},"swJcz",[106,175,176],{"class":131},"{",[106,178,179],{"class":173}," role",[106,181,182],{"class":131},":",[106,184,185],{"class":131}," '",[106,187,189],{"class":188},"sfazB","authenticated",[106,191,192],{"class":131},"'",[106,194,195],{"class":131},",",[106,197,198],{"class":173}," sub",[106,200,182],{"class":131},[106,202,203],{"class":123}," user",[106,205,206],{"class":131},".",[106,208,209],{"class":123},"id",[106,211,212],{"class":131}," }",[106,214,215],{"class":173},")\n",[106,217,219],{"class":108,"line":218},4,[106,220,222],{"emptyLinePlaceholder":221},true,"\n",[106,224,226,229,232,234,236,238],{"class":108,"line":225},5,[106,227,228],{"class":112},"  await",[106,230,231],{"class":119}," setUserSession",[106,233,124],{"class":173},[106,235,136],{"class":123},[106,237,195],{"class":131},[106,239,145],{"class":131},[106,241,243,246,248,251,254,256,258,260,262,264,267,269,271,273,276],{"class":108,"line":242},6,[106,244,245],{"class":173},"    user",[106,247,182],{"class":131},[106,249,250],{"class":131}," {",[106,252,253],{"class":173}," id",[106,255,182],{"class":131},[106,257,203],{"class":123},[106,259,206],{"class":131},[106,261,209],{"class":123},[106,263,195],{"class":131},[106,265,266],{"class":173}," name",[106,268,182],{"class":131},[106,270,203],{"class":123},[106,272,206],{"class":131},[106,274,275],{"class":123},"name",[106,277,278],{"class":131}," },\n",[106,280,282,285,287,289],{"class":108,"line":281},7,[106,283,284],{"class":173},"    postgrest_token",[106,286,182],{"class":131},[106,288,161],{"class":123},[106,290,291],{"class":131},",\n",[106,293,295,298],{"class":108,"line":294},8,[106,296,297],{"class":131},"  }",[106,299,215],{"class":173},[106,301,303,306],{"class":108,"line":302},9,[106,304,305],{"class":131},"}",[106,307,215],{"class":123},[61,309,310],{},"Where you store it decides who can use it:",[312,313,314,336],"table",{},[315,316,317],"thead",{},[318,319,320,324,330],"tr",{},[321,322,323],"th",{},"Stored at",[321,325,326,329],{},[65,327,328],{},"usePostgrest()"," (client + SSR)",[321,331,332,335],{},[65,333,334],{},"usePostgrestUser()"," (server)",[337,338,339,352],"tbody",{},[318,340,341,347,350],{},[342,343,344],"td",{},[65,345,346],{},"session.postgrest_token",[342,348,349],{},"✅",[342,351,349],{},[318,353,354,359,362],{},[342,355,356],{},[65,357,358],{},"session.secure.postgrest_token",[342,360,361],{},"❌",[342,363,349],{},[365,366,367,368,371],"tip",{},"If you only query from server routes, store the token under ",[65,369,370],{},"secure",". It never reaches the browser, and the browser never talks to PostgREST directly.",[61,373,374],{},"Type the session field so it autocompletes:",[96,376,379],{"className":98,"code":377,"filename":378,"language":101,"meta":102,"style":102},"declare module '#auth-utils' {\n  interface UserSession {\n    postgrest_token?: string\n  }\n}\nexport {}\n","shared\u002Ftypes\u002Fauth.d.ts",[65,380,381,398,409,419,424,429],{"__ignoreMap":102},[106,382,383,386,389,391,394,396],{"class":108,"line":109},[106,384,385],{"class":127},"declare",[106,387,388],{"class":127}," module",[106,390,185],{"class":131},[106,392,393],{"class":188},"#auth-utils",[106,395,192],{"class":131},[106,397,145],{"class":131},[106,399,400,403,407],{"class":108,"line":148},[106,401,402],{"class":127},"  interface",[106,404,406],{"class":405},"sBMFI"," UserSession",[106,408,145],{"class":131},[106,410,411,413,416],{"class":108,"line":155},[106,412,284],{"class":173},[106,414,415],{"class":131},"?:",[106,417,418],{"class":405}," string\n",[106,420,421],{"class":108,"line":218},[106,422,423],{"class":131},"  }\n",[106,425,426],{"class":108,"line":225},[106,427,428],{"class":131},"}\n",[106,430,431,433],{"class":108,"line":242},[106,432,113],{"class":112},[106,434,435],{"class":131}," {}\n",[70,437,439],{"id":438},"with-any-other-auth-library","With any other auth library",[61,441,442,444,445,449],{},[65,443,85],{}," is the only auth library this module knows about. Anything else — Better Auth, a custom session, your own JWT issuer — isn't special-cased: write a small function that pulls the token out of ",[446,447,448],"em",{},"your"," session however that library exposes it, and pass the result in yourself:",[96,451,453],{"className":98,"code":452,"language":101,"meta":102,"style":102},"const postgrest = usePostgrest({ token: myAuth.accessToken })\n",[65,454,455],{"__ignoreMap":102},[106,456,457,460,463,466,469,471,473,475,477,480,482,485,487],{"class":108,"line":109},[106,458,459],{"class":127},"const",[106,461,462],{"class":123}," postgrest ",[106,464,465],{"class":131},"=",[106,467,468],{"class":119}," usePostgrest",[106,470,124],{"class":123},[106,472,176],{"class":131},[106,474,161],{"class":173},[106,476,182],{"class":131},[106,478,479],{"class":123}," myAuth",[106,481,206],{"class":131},[106,483,484],{"class":123},"accessToken ",[106,486,305],{"class":131},[106,488,215],{"class":123},[96,490,493],{"className":98,"code":491,"filename":492,"language":101,"meta":102,"style":102},"export default defineEventHandler(async (event) => {\n  const token = await getTokenSomehow(event)\n  const postgrest = await usePostgrestUser(event, { token })\n  \u002F\u002F ...\n})\n","server\u002Fapi\u002Ftodos.get.ts",[65,494,495,517,536,564,569],{"__ignoreMap":102},[106,496,497,499,501,503,505,507,509,511,513,515],{"class":108,"line":109},[106,498,113],{"class":112},[106,500,116],{"class":112},[106,502,120],{"class":119},[106,504,124],{"class":123},[106,506,128],{"class":127},[106,508,132],{"class":131},[106,510,136],{"class":135},[106,512,139],{"class":131},[106,514,142],{"class":127},[106,516,145],{"class":131},[106,518,519,521,523,525,527,530,532,534],{"class":108,"line":148},[106,520,158],{"class":127},[106,522,161],{"class":123},[106,524,164],{"class":131},[106,526,167],{"class":112},[106,528,529],{"class":119}," getTokenSomehow",[106,531,124],{"class":173},[106,533,136],{"class":123},[106,535,215],{"class":173},[106,537,538,540,543,545,547,550,552,554,556,558,560,562],{"class":108,"line":155},[106,539,158],{"class":127},[106,541,542],{"class":123}," postgrest",[106,544,164],{"class":131},[106,546,167],{"class":112},[106,548,549],{"class":119}," usePostgrestUser",[106,551,124],{"class":173},[106,553,136],{"class":123},[106,555,195],{"class":131},[106,557,250],{"class":131},[106,559,161],{"class":123},[106,561,212],{"class":131},[106,563,215],{"class":173},[106,565,566],{"class":108,"line":218},[106,567,568],{"class":151},"  \u002F\u002F ...\n",[106,570,571,573],{"class":108,"line":225},[106,572,305],{"class":131},[106,574,215],{"class":123},[70,576,578],{"id":577},"anonymous-requests","Anonymous requests",[61,580,581,582,585,586,589,590,206],{},"With no token, the client falls back to the public ",[65,583,584],{},"key",", and with no key it sends no ",[65,587,588],{},"Authorization"," header at all. PostgREST then runs the query as its ",[65,591,592],{},"db-anon-role",[70,594,596],{"id":595},"token-expiry","Token expiry",[61,598,599,600,603,604,607],{},"The module does not refresh tokens. If your PostgREST JWTs expire, reissue them in your auth flow (for example on session refresh) and update the session field. A ",[65,601,602],{},"401"," with ",[65,605,606],{},"PGRST301"," from PostgREST means the token expired or is invalid.",[609,610,611],"style",{},"html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}",{"title":102,"searchDepth":148,"depth":148,"links":613},[614,615,616,617],{"id":72,"depth":148,"text":73},{"id":438,"depth":148,"text":439},{"id":577,"depth":148,"text":578},{"id":595,"depth":148,"text":596},"Forward the user's JWT so PostgREST row-level security applies.","md",null,{},{"icon":44},{"title":41,"description":618},"OX9O4DoAILCQsyhtwZREAkAqYpfVPfhGC_OQIRYhdSc",[626,628],{"title":36,"path":37,"stem":38,"description":627,"icon":39,"children":-1},"usePostgrest, usePostgrestUser, usePostgrestAdmin and createPostgrestClient.",{"title":46,"path":47,"stem":48,"description":629,"icon":49,"children":-1},"Type every table, column and schema from your database.",1790352863872]