The auth orchestrator for Flutter. Not another Identity Provider.
Authyra owns your app's session lifecycle: persistence, token refresh, multi-account switching, events. Plug in Firebase, Auth0, or your own API today; swap it later without touching a screen.
main.dart
// Your own backend today...
await Authyra.instance.signIn('email', params: CredentialsSignInParams(
email: 'alice@example.com',
password: 's3cr3t',
));
// ...add Google next month. Same client, same call shape, no rewrite:
await Authyra.instance.signIn('google');
Providers authenticate. Authyra manages the resulting session.
Most Flutter auth packages bundle the protocol, the identity provider, and your app's session plumbing together. That's convenient until you need a custom backend, a second provider, or more than one signed-in account at once. Authyra sits one layer above: it doesn't replace your provider, it's what happens in your app after that provider says yes.
Pure Dart core
Zero Flutter dependency in
authyra, verified: nothing in the core package imports flutter_*. Unit-test your auth logic with plain dart test, no widget runner required.Provider-agnostic by contract
AuthProvider and AuthStorage are interfaces, not base classes tied to one vendor. Swap Google for a custom API, flutter_secure_storage for Redis, or mock everything in tests.Multi-account as a first-class concept
Several signed-in identities coexist on the device and switch independently through
AccountManager, not bolted on as an afterthought. Personal and work accounts, side by side.Token refresh you don't hand-roll
Providers that set
supportsRefresh: true get automatic background renewal with retry. When refresh is truly exhausted, the session clears and authStateChanges emits, no silent half-states.OAuth2 with PKCE, when you need it
OAuth2Provider (in authyra_flutter) implements the full Authorization Code + PKCE flow. Prebuilt providers for Google and GitHub, a proxy mode that keeps client secrets server-side, and native Sign in with Apple in authyra_apple.Reactive by default
authStateChanges is a broadcast Stream<AuthState> with Equatable deduplication. Wire it to StreamBuilder, Riverpod, Bloc, or GoRouter with zero boilerplate.