Sessions & Remember Me

Remember Me

rememberMe: true issues a 30-day refresh token instead of the default 7-day one. The flag is stored on the session row server-side, so it’s carried forward automatically on every subsequent refreshSession() call — no need to keep resending it.

Supported directly (single call, no follow-up needed) on:

// Password
await postbase.auth.signInWithPassword({ email, password, rememberMe: true })

// Magic link / 6-digit OTP verify
await postbase.auth.verifyOtp({ email, token: '123456', rememberMe: true })

// Email OTP verify (/email-otp/verify flow)
await postbase.auth.verifyEmailOtp({ email, code: '123456', rememberMe: true })

// Native id-token sign-in — Apple / Google native SDKs (requires postbasejs >= 0.5.16)
await postbase.auth.signInWithIdToken({ provider: 'apple', idToken, rememberMe: true })
await postbase.auth.signInWithIdToken({ provider: 'google', idToken, rememberMe: true })

Browser/in-app-browser OAuth redirects are the one exception. They have no request body at the point the session is first issued — the tokens come back as URL query params on the callback, not from a call you control. Use setRememberMe afterwards instead:

// After OAuth login, or whenever a user toggles a "remember me" checkbox
const { data, error } = await postbase.auth.setRememberMe(true)
// data.session.refreshToken is now valid for 30 days

OAuth + remember me (Google, LinkedIn, GitHub, etc.)

Since the browser navigates away to the provider and back, checkbox state won’t survive the round trip on its own — stash it before redirecting, then apply it on the callback page once the session exists:

// Login page — stash intent before redirecting
async function handleGoogleLogin(rememberMe: boolean) {
  sessionStorage.setItem('pb_remember_me', String(rememberMe))
  await postbase.auth.signInWithOAuth({
    provider: 'google',
    options: { redirectTo: `${window.location.origin}/auth/callback` },
  })
}

// app/auth/callback/page.tsx — apply it once the session exists
const { data, error } = await postbase.auth.handleOAuthCallback()
if (data.session) {
  const wantsRememberMe = sessionStorage.getItem('pb_remember_me') === 'true'
  sessionStorage.removeItem('pb_remember_me')

  if (wantsRememberMe) {
    await postbase.auth.setRememberMe(true)
  }
}
router.push('/dashboard')

Only call setRememberMe when the flag is true — the server default is already 7 days.

Get Current User

const { data: { user }, error } = await postbase.auth.getUser()

Get Current Session

const { data: { session }, error } = await postbase.auth.getSession()
// session.accessToken, session.user, session.expiresAt, session.refreshTokenExpiresAt

session.expiresAt is the access token’s expiry (short-lived, ~1 hour) — use it for in-memory refresh scheduling only. session.refreshTokenExpiresAt is the refresh token’s expiry (7 or 30 days depending on rememberMe) — this is what setSession() uses for the cookie’s maxAge.

Update User

const { data, error } = await postbase.auth.updateUser({
  name: 'Alice',
  metadata: { plan: 'pro' },
})

Listen to Auth State Changes

const { data: { subscription } } = postbase.auth.onAuthStateChange((event, session) => {
  // event: 'SIGNED_IN' | 'SIGNED_OUT' | 'TOKEN_REFRESHED' | 'USER_UPDATED'
  console.log(event, session)
})

// Cleanup
subscription.unsubscribe()

Sign Out

await postbase.auth.signOut()