[{"data":1,"prerenderedAt":886},["ShallowReactive",2],{"navigation_docs":3,"-playbooks-auth-sidebase":80,"-playbooks-auth-sidebase-surround":881},[4,20,45],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":6},"Getting Started",false,"\u002Fgetting-started","1.getting-started",[10,15],{"title":11,"path":12,"stem":13,"icon":14},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction","i-lucide-house",{"title":16,"path":17,"stem":18,"icon":19},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation","i-lucide-download",{"title":21,"icon":6,"path":22,"stem":23,"children":24,"page":6},"Guide","\u002Fguide","2.guide",[25,30,35,40],{"title":26,"path":27,"stem":28,"icon":29},"Configuration","\u002Fguide\u002Fconfiguration","2.guide\u002F1.configuration","i-lucide-settings",{"title":31,"path":32,"stem":33,"icon":34},"Composables","\u002Fguide\u002Fcomposables","2.guide\u002F2.composables","i-lucide-code",{"title":36,"path":37,"stem":38,"icon":39},"Authentication","\u002Fguide\u002Fauthentication","2.guide\u002F3.authentication","i-lucide-key-round",{"title":41,"path":42,"stem":43,"icon":44},"Types","\u002Fguide\u002Ftypes","2.guide\u002F4.types","i-lucide-braces",{"title":46,"icon":6,"path":47,"stem":48,"children":49,"page":6},"Playbooks","\u002Fplaybooks","3.playbooks",[50,55,60,65,70,75],{"title":51,"path":52,"stem":53,"icon":54},"Local Postgres & PostgREST","\u002Fplaybooks\u002Flocal-postgrest","3.playbooks\u002F1.local-postgrest","i-simple-icons-docker",{"title":56,"path":57,"stem":58,"icon":59},"Coming from Supabase","\u002Fplaybooks\u002Fcoming-from-supabase","3.playbooks\u002F2.coming-from-supabase","i-lucide-arrow-right-left",{"title":61,"path":62,"stem":63,"icon":64},"Auth with nuxt-auth-utils","\u002Fplaybooks\u002Fauth-nuxt-auth-utils","3.playbooks\u002F3.auth-nuxt-auth-utils","i-lucide-key",{"title":66,"path":67,"stem":68,"icon":69},"Auth with Better Auth","\u002Fplaybooks\u002Fauth-better-auth","3.playbooks\u002F4.auth-better-auth","i-lucide-shield",{"title":71,"path":72,"stem":73,"icon":74},"Auth with Sidebase Nuxt Auth","\u002Fplaybooks\u002Fauth-sidebase","3.playbooks\u002F5.auth-sidebase","i-lucide-user-round-check",{"title":76,"path":77,"stem":78,"icon":79},"Auth with Clerk","\u002Fplaybooks\u002Fauth-clerk","3.playbooks\u002F6.auth-clerk","i-lucide-circle-user-round",{"id":81,"title":71,"body":82,"description":874,"extension":875,"links":876,"meta":877,"navigation":878,"path":72,"seo":879,"stem":73,"__hash__":880},"docs\u002F3.playbooks\u002F5.auth-sidebase.md",{"type":83,"value":84,"toc":866},"minimark",[85,99,109,114,124,158,162,173,520,534,538,632,635,639,642,707,762,765,769,828,834,838,862],[86,87,88,98],"p",{},[89,90,94],"a",{"href":91,"rel":92},"https:\u002F\u002Fsidebase.io\u002Fnuxt-auth",[93],"nofollow",[95,96,97],"code",{},"@sidebase\u002Fnuxt-auth"," wraps Auth.js, which owns the sign-in endpoints. So you derive the PostgREST token from the session: a server utility does it, a middleware keeps it fresh on every request, and a route lets the browser sync when it signs in without a redirect.",[100,101,102,103,108],"note",{},"This guide was checked against the package's published types, not run end to end. Set up the library itself with ",[89,104,107],{"href":105,"rel":106},"https:\u002F\u002Fsidebase.io\u002Fnuxt-auth\u002Fgetting-started",[93],"its docs",".",[110,111,113],"h2",{"id":112},"_1-before-you-start","1. Before you start",[86,115,116,117,119,120,123],{},"You need ",[95,118,97],{}," working with its ",[95,121,122],{},"NuxtAuthHandler",", and the JWT secret for the module:",[125,126,132],"pre",{"className":127,"code":128,"filename":129,"language":130,"meta":131,"style":131},"language-bash shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","# Must equal PostgREST's jwt-secret (PGRST_JWT_SECRET)\nNUXT_POSTGREST_JWT_SECRET=replace-with-a-secret-of-at-least-32-characters\n",".env","bash","",[95,133,134,143],{"__ignoreMap":131},[135,136,139],"span",{"class":137,"line":138},"line",1,[135,140,142],{"class":141},"sHwdD","# Must equal PostgREST's jwt-secret (PGRST_JWT_SECRET)\n",[135,144,146,150,154],{"class":137,"line":145},2,[135,147,149],{"class":148},"sTEyZ","NUXT_POSTGREST_JWT_SECRET",[135,151,153],{"class":152},"sMK4o","=",[135,155,157],{"class":156},"sfazB","replace-with-a-secret-of-at-least-32-characters\n",[110,159,161],{"id":160},"_2-turn-the-session-into-a-token","2. Turn the session into a token",[86,163,164,165,168,169,172],{},"The session's ",[95,166,167],{},"user"," has no id by default, so read the user id from the decoded Auth.js token (",[95,170,171],{},"sub",") and the expiry from the session:",[125,174,179],{"className":175,"code":176,"filename":177,"language":178,"meta":131,"style":131},"language-ts shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","import type { H3Event } from 'h3'\nimport { getServerSession, getToken } from '#auth'\n\n\u002F** Make the PostgREST token cookie match the current Auth.js session. *\u002F\nexport async function syncPostgrestToken(event: H3Event) {\n  const session = await getServerSession(event)\n  const token = await getToken({ event })\n\n  if (!session || !token?.sub) {\n    clearPostgrestToken(event)\n    return\n  }\n\n  setPostgrestToken(\n    event,\n    await mintJwt(\n      { role: 'authenticated', sub: token.sub },\n      { expiresAt: new Date(session.expires) },\n    ),\n  )\n}\n","server\u002Futils\u002Fpostgrest-token.ts","ts",[95,180,181,211,237,244,250,286,311,337,342,377,389,395,401,406,415,424,435,470,500,508,514],{"__ignoreMap":131},[135,182,183,187,190,193,196,199,202,205,208],{"class":137,"line":138},[135,184,186],{"class":185},"s7zQu","import",[135,188,189],{"class":185}," type",[135,191,192],{"class":152}," {",[135,194,195],{"class":148}," H3Event",[135,197,198],{"class":152}," }",[135,200,201],{"class":185}," from",[135,203,204],{"class":152}," '",[135,206,207],{"class":156},"h3",[135,209,210],{"class":152},"'\n",[135,212,213,215,217,220,223,226,228,230,232,235],{"class":137,"line":145},[135,214,186],{"class":185},[135,216,192],{"class":152},[135,218,219],{"class":148}," getServerSession",[135,221,222],{"class":152},",",[135,224,225],{"class":148}," getToken",[135,227,198],{"class":152},[135,229,201],{"class":185},[135,231,204],{"class":152},[135,233,234],{"class":156},"#auth",[135,236,210],{"class":152},[135,238,240],{"class":137,"line":239},3,[135,241,243],{"emptyLinePlaceholder":242},true,"\n",[135,245,247],{"class":137,"line":246},4,[135,248,249],{"class":141},"\u002F** Make the PostgREST token cookie match the current Auth.js session. *\u002F\n",[135,251,253,256,260,263,267,270,274,277,280,283],{"class":137,"line":252},5,[135,254,255],{"class":185},"export",[135,257,259],{"class":258},"spNyl"," async",[135,261,262],{"class":258}," function",[135,264,266],{"class":265},"s2Zo4"," syncPostgrestToken",[135,268,269],{"class":152},"(",[135,271,273],{"class":272},"sHdIc","event",[135,275,276],{"class":152},":",[135,278,195],{"class":279},"sBMFI",[135,281,282],{"class":152},")",[135,284,285],{"class":152}," {\n",[135,287,289,292,295,298,301,303,306,308],{"class":137,"line":288},6,[135,290,291],{"class":258},"  const",[135,293,294],{"class":148}," session",[135,296,297],{"class":152}," =",[135,299,300],{"class":185}," await",[135,302,219],{"class":265},[135,304,269],{"class":305},"swJcz",[135,307,273],{"class":148},[135,309,310],{"class":305},")\n",[135,312,314,316,319,321,323,325,327,330,333,335],{"class":137,"line":313},7,[135,315,291],{"class":258},[135,317,318],{"class":148}," token",[135,320,297],{"class":152},[135,322,300],{"class":185},[135,324,225],{"class":265},[135,326,269],{"class":305},[135,328,329],{"class":152},"{",[135,331,332],{"class":148}," event",[135,334,198],{"class":152},[135,336,310],{"class":305},[135,338,340],{"class":137,"line":339},8,[135,341,243],{"emptyLinePlaceholder":242},[135,343,345,348,351,354,357,360,363,366,369,371,374],{"class":137,"line":344},9,[135,346,347],{"class":185},"  if",[135,349,350],{"class":305}," (",[135,352,353],{"class":152},"!",[135,355,356],{"class":148},"session",[135,358,359],{"class":152}," ||",[135,361,362],{"class":152}," !",[135,364,365],{"class":148},"token",[135,367,368],{"class":152},"?.",[135,370,171],{"class":148},[135,372,373],{"class":305},") ",[135,375,376],{"class":152},"{\n",[135,378,380,383,385,387],{"class":137,"line":379},10,[135,381,382],{"class":265},"    clearPostgrestToken",[135,384,269],{"class":305},[135,386,273],{"class":148},[135,388,310],{"class":305},[135,390,392],{"class":137,"line":391},11,[135,393,394],{"class":185},"    return\n",[135,396,398],{"class":137,"line":397},12,[135,399,400],{"class":152},"  }\n",[135,402,404],{"class":137,"line":403},13,[135,405,243],{"emptyLinePlaceholder":242},[135,407,409,412],{"class":137,"line":408},14,[135,410,411],{"class":265},"  setPostgrestToken",[135,413,414],{"class":305},"(\n",[135,416,418,421],{"class":137,"line":417},15,[135,419,420],{"class":148},"    event",[135,422,423],{"class":152},",\n",[135,425,427,430,433],{"class":137,"line":426},16,[135,428,429],{"class":185},"    await",[135,431,432],{"class":265}," mintJwt",[135,434,414],{"class":305},[135,436,438,441,444,446,448,451,454,456,459,461,463,465,467],{"class":137,"line":437},17,[135,439,440],{"class":152},"      {",[135,442,443],{"class":305}," role",[135,445,276],{"class":152},[135,447,204],{"class":152},[135,449,450],{"class":156},"authenticated",[135,452,453],{"class":152},"'",[135,455,222],{"class":152},[135,457,458],{"class":305}," sub",[135,460,276],{"class":152},[135,462,318],{"class":148},[135,464,108],{"class":152},[135,466,171],{"class":148},[135,468,469],{"class":152}," },\n",[135,471,473,475,478,480,483,486,488,490,492,495,497],{"class":137,"line":472},18,[135,474,440],{"class":152},[135,476,477],{"class":305}," expiresAt",[135,479,276],{"class":152},[135,481,482],{"class":152}," new",[135,484,485],{"class":265}," Date",[135,487,269],{"class":305},[135,489,356],{"class":148},[135,491,108],{"class":152},[135,493,494],{"class":148},"expires",[135,496,373],{"class":305},[135,498,499],{"class":152},"},\n",[135,501,503,506],{"class":137,"line":502},19,[135,504,505],{"class":305},"    )",[135,507,423],{"class":152},[135,509,511],{"class":137,"line":510},20,[135,512,513],{"class":305},"  )\n",[135,515,517],{"class":137,"line":516},21,[135,518,519],{"class":152},"}\n",[86,521,522,525,526,529,530,533],{},[95,523,524],{},"getServerSession"," returns the session or ",[95,527,528],{},"null",", and ",[95,531,532],{},"session.expires"," is an ISO date string.",[110,535,537],{"id":536},"_3-run-it-on-every-request","3. Run it on every request",[125,539,542],{"className":175,"code":540,"filename":541,"language":178,"meta":131,"style":131},"export default defineEventHandler(async (event) => {\n  \u002F\u002F Auth.js's own endpoints don't need a token\n  if (event.path.startsWith('\u002Fapi\u002Fauth')) return\n\n  await syncPostgrestToken(event)\n})\n","server\u002Fmiddleware\u002Fpostgrest-token.ts",[95,543,544,570,575,608,612,625],{"__ignoreMap":131},[135,545,546,548,551,554,556,559,561,563,565,568],{"class":137,"line":138},[135,547,255],{"class":185},[135,549,550],{"class":185}," default",[135,552,553],{"class":265}," defineEventHandler",[135,555,269],{"class":148},[135,557,558],{"class":258},"async",[135,560,350],{"class":152},[135,562,273],{"class":272},[135,564,282],{"class":152},[135,566,567],{"class":258}," =>",[135,569,285],{"class":152},[135,571,572],{"class":137,"line":145},[135,573,574],{"class":141},"  \u002F\u002F Auth.js's own endpoints don't need a token\n",[135,576,577,579,581,583,585,588,590,593,595,597,600,602,605],{"class":137,"line":239},[135,578,347],{"class":185},[135,580,350],{"class":305},[135,582,273],{"class":148},[135,584,108],{"class":152},[135,586,587],{"class":148},"path",[135,589,108],{"class":152},[135,591,592],{"class":265},"startsWith",[135,594,269],{"class":305},[135,596,453],{"class":152},[135,598,599],{"class":156},"\u002Fapi\u002Fauth",[135,601,453],{"class":152},[135,603,604],{"class":305},")) ",[135,606,607],{"class":185},"return\n",[135,609,610],{"class":137,"line":246},[135,611,243],{"emptyLinePlaceholder":242},[135,613,614,617,619,621,623],{"class":137,"line":252},[135,615,616],{"class":185},"  await",[135,618,266],{"class":265},[135,620,269],{"class":305},[135,622,273],{"class":148},[135,624,310],{"class":305},[135,626,627,630],{"class":137,"line":288},[135,628,629],{"class":152},"}",[135,631,310],{"class":148},[86,633,634],{},"The cookie follows the session on every page and API request, including when Auth.js extends it, and it clears when the session ends.",[110,636,638],{"id":637},"_4-after-a-sign-in-that-doesnt-redirect","4. After a sign-in that doesn't redirect",[86,640,641],{},"The default sign-in flow redirects, which loads a page from your server, so the middleware already sets the token. If you sign in without a redirect, the browser has to ask for the token:",[125,643,646],{"className":175,"code":644,"filename":645,"language":178,"meta":131,"style":131},"export default defineEventHandler(async (event) => {\n  await syncPostgrestToken(event)\n  return { ok: true }\n})\n","server\u002Fapi\u002Fpostgrest-token.post.ts",[95,647,648,670,682,701],{"__ignoreMap":131},[135,649,650,652,654,656,658,660,662,664,666,668],{"class":137,"line":138},[135,651,255],{"class":185},[135,653,550],{"class":185},[135,655,553],{"class":265},[135,657,269],{"class":148},[135,659,558],{"class":258},[135,661,350],{"class":152},[135,663,273],{"class":272},[135,665,282],{"class":152},[135,667,567],{"class":258},[135,669,285],{"class":152},[135,671,672,674,676,678,680],{"class":137,"line":145},[135,673,616],{"class":185},[135,675,266],{"class":265},[135,677,269],{"class":305},[135,679,273],{"class":148},[135,681,310],{"class":305},[135,683,684,687,689,692,694,698],{"class":137,"line":239},[135,685,686],{"class":185},"  return",[135,688,192],{"class":152},[135,690,691],{"class":305}," ok",[135,693,276],{"class":152},[135,695,697],{"class":696},"sfNiH"," true",[135,699,700],{"class":152}," }\n",[135,702,703,705],{"class":137,"line":246},[135,704,629],{"class":152},[135,706,310],{"class":148},[125,708,710],{"className":175,"code":709,"language":178,"meta":131,"style":131},"await $fetch('\u002Fapi\u002Fpostgrest-token', { method: 'POST' })\nawait refreshNuxtData() \u002F\u002F re-run queries, now as the user\n",[95,711,712,749],{"__ignoreMap":131},[135,713,714,717,720,722,724,727,729,731,733,736,738,740,743,745,747],{"class":137,"line":138},[135,715,716],{"class":185},"await",[135,718,719],{"class":265}," $fetch",[135,721,269],{"class":148},[135,723,453],{"class":152},[135,725,726],{"class":156},"\u002Fapi\u002Fpostgrest-token",[135,728,453],{"class":152},[135,730,222],{"class":152},[135,732,192],{"class":152},[135,734,735],{"class":305}," method",[135,737,276],{"class":152},[135,739,204],{"class":152},[135,741,742],{"class":156},"POST",[135,744,453],{"class":152},[135,746,198],{"class":152},[135,748,310],{"class":148},[135,750,751,753,756,759],{"class":137,"line":145},[135,752,716],{"class":185},[135,754,755],{"class":265}," refreshNuxtData",[135,757,758],{"class":148},"() ",[135,760,761],{"class":141},"\u002F\u002F re-run queries, now as the user\n",[86,763,764],{},"Call it after signing out as well: it finds no session and clears the cookie.",[110,766,768],{"id":767},"_5-query-as-the-user","5. Query as the user",[125,770,772],{"className":175,"code":771,"language":178,"meta":131,"style":131},"const { data } = await usePostgrest().from('todos').select('*')\n",[95,773,774],{"__ignoreMap":131},[135,775,776,779,781,784,786,788,790,793,796,798,801,803,805,808,810,812,814,817,819,821,824,826],{"class":137,"line":138},[135,777,778],{"class":258},"const",[135,780,192],{"class":152},[135,782,783],{"class":148}," data ",[135,785,629],{"class":152},[135,787,297],{"class":152},[135,789,300],{"class":185},[135,791,792],{"class":265}," usePostgrest",[135,794,795],{"class":148},"()",[135,797,108],{"class":152},[135,799,800],{"class":265},"from",[135,802,269],{"class":148},[135,804,453],{"class":152},[135,806,807],{"class":156},"todos",[135,809,453],{"class":152},[135,811,282],{"class":148},[135,813,108],{"class":152},[135,815,816],{"class":265},"select",[135,818,269],{"class":148},[135,820,453],{"class":152},[135,822,823],{"class":156},"*",[135,825,453],{"class":152},[135,827,310],{"class":148},[86,829,830,831,833],{},"Your RLS policies can read the ",[95,832,171],{}," claim, which is the Auth.js user id.",[110,835,837],{"id":836},"things-to-know","Things to know",[839,840,841,853],"ul",{},[842,843,844,848,849,852],"li",{},[845,846,847],"strong",{},"Revocation."," A token already in the browser keeps working until its ",[95,850,851],{},"exp",", even after the session is gone. The middleware removes it on that user's next request.",[842,854,855,858,859,861],{},[845,856,857],{},"Session strategy."," With the default JWT strategy, ",[95,860,532],{}," is when Auth.js considers the session to end, so the token follows it.",[863,864,865],"style",{},"html pre.shiki code .sHwdD, html code.shiki .sHwdD{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#546E7A;--shiki-default-font-style:italic;--shiki-dark:#676E95;--shiki-dark-font-style:italic}html pre.shiki code .sTEyZ, html code.shiki .sTEyZ{--shiki-light:#90A4AE;--shiki-default:#EEFFFF;--shiki-dark:#BABED8}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s7zQu, html code.shiki .s7zQu{--shiki-light:#39ADB5;--shiki-light-font-style:italic;--shiki-default:#89DDFF;--shiki-default-font-style:italic;--shiki-dark:#89DDFF;--shiki-dark-font-style:italic}html pre.shiki code .spNyl, html code.shiki .spNyl{--shiki-light:#9C3EDA;--shiki-default:#C792EA;--shiki-dark:#C792EA}html pre.shiki code .s2Zo4, html code.shiki .s2Zo4{--shiki-light:#6182B8;--shiki-default:#82AAFF;--shiki-dark:#82AAFF}html pre.shiki code .sHdIc, html code.shiki .sHdIc{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#EEFFFF;--shiki-default-font-style:italic;--shiki-dark:#BABED8;--shiki-dark-font-style:italic}html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .swJcz, html code.shiki .swJcz{--shiki-light:#E53935;--shiki-default:#F07178;--shiki-dark:#F07178}html pre.shiki code .sfNiH, html code.shiki .sfNiH{--shiki-light:#FF5370;--shiki-default:#FF9CAC;--shiki-dark:#FF9CAC}",{"title":131,"searchDepth":145,"depth":145,"links":867},[868,869,870,871,872,873],{"id":112,"depth":145,"text":113},{"id":160,"depth":145,"text":161},{"id":536,"depth":145,"text":537},{"id":637,"depth":145,"text":638},{"id":767,"depth":145,"text":768},{"id":836,"depth":145,"text":837},"Keep a PostgREST token in step with your Auth.js session.","md",null,{},{"icon":74},{"title":71,"description":874},"1NgBXsrBXB8SZ6FmxWE1UdiG4AkLXhpTyV5vH3RW5SU",[882,884],{"title":66,"path":67,"stem":68,"description":883,"icon":69,"children":-1},"Keep a PostgREST token in step with your Better Auth session.",{"title":76,"path":77,"stem":78,"description":885,"icon":79,"children":-1},"Run PostgREST queries as the user who is signed in with Clerk.",1792365098928]