API Reference
AuthProvider
Complete API reference for the AuthProvider abstract interface.
Overview
AuthProvider is the extension point for every authentication strategy. Implement it once to plug a new strategy into AuthyraClient; only signIn is required.
abstract class AuthProvider {
String get id;
String get name => id;
bool get supportsRefresh => false;
bool get supportsSignOut => false;
Future<AuthSignInResult?> signIn({AuthSignInParams? params});
Future<void> signOut({String? userId}) async {}
Future<AuthTokenResult?> refreshToken(String refreshToken) async => null;
}
See Providers → for the full design rationale and a custom-provider walkthrough.
Members
| Member | Required | Description |
|---|---|---|
id | yes | Unique lowercase slug within one AuthyraClient ('google', 'email'). Registering a duplicate throws ProviderAlreadyRegisteredException. |
name | no | Human-readable label for logs/UI. Defaults to id. |
supportsRefresh | no | Opt in to silent token renewal. Default false. |
supportsSignOut | no | Opt in to server-side revocation on sign-out. Default false. |
signIn | yes | Authenticate the user; return null on credential failure (converted to AuthenticationFailedException), throw for infrastructure errors. |
signOut | no | Revoke server-side credentials. Only called when supportsSignOut: true. Must never throw. |
refreshToken | no | Exchange a refresh token for new tokens. Only called when supportsRefresh: true. Return null when the refresh token is invalid or expired. |
Providers are stateless: they hold configuration, never session state. Session state lives in SessionManager.
Result types
AuthSignInResult
Returned by signIn.
class AuthSignInResult {
final AuthUser user;
final AuthAccount? account; // omit it; AuthyraClient builds a minimal one
final String? accessToken;
final String? refreshToken;
final DateTime? expiresAt;
const AuthSignInResult.userOnly(AuthUser user); // cookie/opaque-session shortcut
}
accessToken and refreshToken are application session tokens, the values AuthyraClient stores on the session and returns via getAccessToken(). A provider that only acquires a third-party identity credential without exchanging it for an application session itself (Sign in with Apple's identityToken, for example) must leave these null and put the raw credential in AuthAccount.providerData instead. See authyra_apple's AppleProvider for a provider built around this exact distinction.AuthTokenResult
Returned by refreshToken.
class AuthTokenResult {
final String accessToken;
final String? refreshToken; // null keeps the existing one
final DateTime expiresAt;
}
Built-in providers
| Provider | Package | Strategy |
|---|---|---|
CredentialsProvider | authyra | Email/password or any form-based flow |
CredentialsProvider.withTokens | authyra | Same, backend also returns tokens |
OAuth2Provider | authyra_flutter | Browser-based Authorization Code + PKCE |
GoogleProvider | authyra_flutter | OAuth2Provider preconfigured for Google |
GitHubProvider | authyra_flutter | OAuth2Provider preconfigured for GitHub |
ProxyOAuthProvider | authyra_flutter | Backend-delegated OAuth |
AppleProvider | authyra_apple | Native Sign in with Apple SDK |
AuthSignInParams
signIn's params is a typed hierarchy, not a raw map:
abstract class AuthSignInParams {
const AuthSignInParams();
}
class CredentialsSignInParams extends AuthSignInParams {
final String email;
final String password;
}
class OAuth2SignInParams extends AuthSignInParams {
final String? code;
final String? state;
final String? redirectUri;
final List<String>? scopes;
}
Cast to the expected subclass inside your provider:
Future<AuthSignInResult?> signIn({AuthSignInParams? params}) async {
final creds = params is CredentialsSignInParams ? params : null;
// creds?.email, creds?.password
}