Lesson 3 / 97 min read

Accounts API: devany.auth

Signup, login, verification and reset — with their error codes.

The core flow

// Kayıt + giriş (ikisi de oturumu açar)
const user = await devany.auth.signup(email, password, name);
const user = await devany.auth.login(email, password);

devany.auth.isSignedIn();            // senkron kapı kontrolü
const me = await devany.auth.me();   // { id, email, name, verified } | null
devany.auth.logout();

// Şifre yönetimi
await devany.auth.changePassword(oldPw, newPw);
await devany.auth.requestReset(email);                  // kod e-postalanır
await devany.auth.resetPassword(email, code, newPw);

// E-posta doğrulama (opsiyonel)
await devany.auth.requestVerify();
await devany.auth.confirmVerify(code);

Error codes

	When
email_taken	That email is already registered
weak_password	Password shorter than 6 chars
bad_credentials	Wrong login or wrong current password
locked	Too many attempts — wait a few minutes
signup_rate	The app hit its hourly signup cap
bad_code / code_expired	Verify/reset code is wrong or expired
mail_disabled	Code email cannot be sent (email is off)
not_signed_in	Session lapsed — return to the login screen

Password reset flow

requestReset(email)

A 6-digit code is emailed

User enters the code

Valid for 15 minutes

resetPassword(...)

New password ≥6 chars

The code is single-use

Try it yourself

Try it yourself: build a login gate

Correctly gate a per-person screen behind a login.

1Call devany.auth.me() on load; if it returns null, show the login screen.
2Put login and signup on one screen with a link to switch.
3Add a "forgot password" link and wire the two-step reset.
4Map every error code to a message in the user's language (never show raw codes).
5Put devany.user calls behind the isSignedIn() gate.

What you should end up with

A gate that returns the user to the right screen even when the session lapses, with human error messages.

Key takeaways

Sessions last for the tab; a refresh requires signing in again.
requestReset never enumerates — and neither should your UI.
Code emails only go out on a published, email-enabled app.