Check Authentication
Get Current User
User Object
Get Session
Session Object
Listen for Auth Changes
React Hook
Refresh Session
Sessions are automatically refreshed before expiry. You can also manually refresh:Session Storage
Sessions are stored in:- localStorage:
gately_session_{projectId} - Cookies:
gately_auth_token,gately_project_id
Why Both?
- localStorage: Primary storage, survives page reloads
- Cookies: Enables cross-origin requests (e.g., Framer fetch)
Session Expiry
When the access token expires:
- SDK automatically uses refresh token
- New access token is obtained
- Session is updated in storage
- User is logged out
- Session is cleared
- Auth state callbacks are triggered
Auto Refresh
Auto refresh is enabled by default:Logout
- Call the logout API endpoint
- Clear localStorage
- Clear cookies
- Trigger auth state callbacks
- Handle redirect (if configured)
Session Persistence
Sessions persist across:- Page reloads
- Browser tabs (same origin)
- Browser restarts (until expiry)
- Different browsers
- Incognito/private mode
- Cleared browser data
Multiple Tabs
The SDK handles multiple tabs gracefully:Server-Side Rendering
For SSR frameworks (Next.js, etc.):Security Considerations
Token Storage
Token Storage
Tokens are stored in localStorage and cookies. For high-security applications, consider additional measures like HTTP-only cookies (requires server-side setup).
XSS Protection
XSS Protection
Never expose tokens in URLs or log them to console in production.
CSRF Protection
CSRF Protection
The SDK uses SameSite cookies and validates the origin of requests.
Debugging
Enable debug mode to see session operations:- Session save/restore operations
- Token refresh attempts
- Auth state changes