SDK reference

import { ZKAuthSDK } from 'zkauth-client'
const zkauth = new ZKAuthSDK({  apiKey: loadServerOnlyProjectKey(), // direct API / server-side mode  baseUrl: 'https://api.zkauth.dev', // optional  timeout: 30000, // optional, ms  debug: false,   // optional})

import { ZKAuthSDK } from 'zkauth-client'
const zkauth = new ZKAuthSDK({  hostedProxy: {    baseUrl: 'https://zkauth.dev',    projectSlug: 'your-project-slug',    clientId: 'your_public_client_id',  },})
const options = await zkauth.webAuthnAuthenticationOptions({ userId })// Your browser UI converts options and runs navigator.credentials.get(...).const login = await zkauth.webAuthnAuthenticationVerify({  userId,  response: credentialResponse,  deviceInfo,})

import { preloadProofArtifacts, ZKAuthSDK } from 'zkauth-client'
const artifacts = {  wasm: process.env.AUTH_V2_WASM_URL!,  zkey: process.env.AUTH_V2_ZKEY_URL!,}
const zkauth = new ZKAuthSDK({  apiKey: process.env.ZKAUTH_API_KEY!,  baseUrl: process.env.ZKAUTH_BASE_URL ?? 'http://127.0.0.1:3000',  experimentalProofV2Artifacts: artifacts,})
await preloadProofArtifacts(artifacts)await zkauth.register({ email, password, deviceInfo })// Complete email verification before login.await zkauth.login({ email, password, deviceInfo })

import { redeemZKAuthHostedHandoff } from '@zkauth/node'
export async function GET(request: Request) {  const url = new URL(request.url)  const code = url.searchParams.get('code')  const handoff = await redeemZKAuthHostedHandoff({    apiKey: loadServerOnlyProjectKey(),    baseUrl: loadServerOnlyApiBaseUrl(),  }, code)
  // Store handoff.sessionToken in your own HttpOnly, Secure, host-only cookie.  // Do not expose it in the URL or client-side storage.  return Response.redirect(new URL('/dashboard', request.url))}

import { introspectZKAuthMachineToken } from '@zkauth/node'
const machine = await introspectZKAuthMachineToken(  {    apiKey: loadServerOnlyProjectKey(),    baseUrl: loadServerOnlyApiBaseUrl(),  },  {    audience: 'zkauth:client:00000000-0000-4000-8000-000000000001',    issuer: 'https://api.zkauth.dev',  },)
if (!machine.active) {  throw new Error('ZKAuth machine token is not active')}

const res = await zkauth.register({  email: 'ada@example.com',  password: 'SecurePassword123!',           // min 8 chars, stays on device  deviceInfo: { deviceName: 'Chrome on Mac', deviceType: 'desktop' },})// res.data -> { userId, email, emailVerified, verificationToken?, deviceId }

const res = await zkauth.login({  email: 'ada@example.com',  password: 'SecurePassword123!',  deviceInfo: { deviceName: 'Chrome on Mac', deviceType: 'desktop' },})// res.data -> { user, session, mfaRequired?, deviceApprovalRequired? }const token = res.data.session.token

await zkauth.getCurrentUser()  // -> User | nullzkauth.isAuthenticated()       // -> booleanzkauth.getSession()            // -> Session | nullawait zkauth.logout()          // clears the in-memory session

// register() may return data.verificationToken in devawait zkauth.verifyEmail(token)

const ceremony = await zkauth.issuePairingChallenge({  pairingToken,  email,})
const pairing = await zkauth.completePairing({  pairingToken,  email,  password,  deviceInfo: { ...deviceInfo, deviceFingerprint },  ceremony,})
if (pairing.outcome !== 'authenticated') {  // Continue with pairing.token and pairing.availableMethods.  // Pairing never marks MFA verified by itself.}

// Trusted issuer backend: the issuer controls the role and provisions// issuerGeneratedFieldSecret to the holder through its secure workflow.const projectSdk = new ZKAuthSDK({  apiKey: loadServerOnlyProjectKey(),  clientId: publicClientId,  baseUrl: 'http://127.0.0.1:3000',})const enrollment = await projectSdk.enrollAccessCredential({  organizationId,  credentialSecret: issuerGeneratedFieldSecret,  roleTier: issuerAssignedRoleTier,  credentialVersion: 1,})const context = await projectSdk.requestAccessPassProveContext({  organizationId,  credentialId: enrollment.credentialId,})
// Separate browser/public client: no project API key.const publicSdk = new ZKAuthSDK({  baseUrl: 'http://127.0.0.1:3000',  experimentalAccessPassPublicClientId: publicClientId,  experimentalAccessPassArtifacts: { wasm: wasmUrl, zkey: zkeyUrl },})const ceremony = await publicSdk.requestAccessPassChallenge({  organizationId,  audience: window.location.origin,  action: 'reports:read',  minimumRoleTier: 2,})const proof = await publicSdk.generateAccessPassProof({  organizationId,  credentialId: enrollment.credentialId,  credentialSecret: issuerGeneratedFieldSecret,  roleTier: issuerAssignedRoleTier,  credentialVersion: 1,  ceremony,  context,})const capability = await publicSdk.verifyAccessPass({  organizationId,  audience: window.location.origin,  ceremony,  ...proof,})

await zkauth.forgotPassword({ email: 'ada@example.com' })await zkauth.verifyResetToken(token)await zkauth.resetPassword({ token, newPassword: 'NewSecret123!', email })

await zkauth.getDevices()                       // -> Device[]const device = await zkauth.registerDevice({ deviceInfo }) // keep device.deviceSecret securelyawait zkauth.verifyDevice({ deviceId, deviceSecret })await zkauth.removeDevice(deviceId)

import { ZKAuthError, ZKAuthErrorCode } from 'zkauth-client'
try {  await zkauth.login({ email, password, deviceInfo })} catch (e) {  if (e instanceof ZKAuthError && e.code === ZKAuthErrorCode.MFA_REQUIRED) {    await zkauth.verifyMFA({      token: e.details.token,      code: '123456',      codeType: 'totp', // or 'backup'    })  }}

const off = zkauth.on('login', (user) => console.log('signed in', user.email))zkauth.on('session_expired', () => redirectToLogin())off() // unsubscribe

import { ZKAuthError, ZKAuthErrorCode } from 'zkauth-client'
try {  await zkauth.login({ email, password })} catch (e) {  if (e instanceof ZKAuthError && e.code === ZKAuthErrorCode.AUTHENTICATION_ERROR) {    // wrong credentials / failed proof  }}