API Reference
AuthStorage
Complete API reference for the AuthStorage abstract interface.
Overview
AuthStorage is the single persistence contract used by SessionManager. The core package ships no concrete implementation by design; you supply a backend suited to your runtime.
abstract class AuthStorage {
Future<void> initialize();
Future<String?> read(String key);
Future<void> write(String key, String value);
Future<bool> delete(String key);
Future<void> clear();
Future<bool> containsKey(String key);
Future<List<String>> getKeysWithPrefix(String prefix);
}
See Storage → for security guidance and a full custom-backend walkthrough.
Methods
| Method | Description |
|---|---|
initialize() | One-time setup: key derivation, DB connection, schema migration. Must be idempotent, called and awaited before any other method. |
read(key) | Return the stored string, or null if absent. Never throws for a missing key. |
write(key, value) | Persist value under key, overwriting any existing entry. Must be durable, survives process restarts. |
delete(key) | Remove key. Returns true if it existed, false if absent. Never throws for a missing key. |
clear() | Delete all entries managed by this storage instance. Irreversible; call only during a full sign-out-all or factory reset. |
containsKey(key) | true if key is present. |
getKeysWithPrefix(prefix) | Return every key starting with prefix. SessionManager uses getKeysWithPrefix('session:') to enumerate every persisted account at startup, so a custom backend must return the complete matching set, not a partial one. |
Built-in implementations
| Implementation | Package | Use |
|---|---|---|
InMemoryStorage | authyra | Tests and development. Non-persistent, resets between test cases. |
SecureAuthStorage | authyra_flutter | Production Flutter apps. Wraps flutter_secure_storage (Keychain / Keystore / Web Crypto). |
// Tests
AuthyraClient(providers: [...], storage: InMemoryStorage());
// Flutter production
AuthyraClient(providers: [...], storage: SecureAuthStorage());
For a Dart backend, implement AuthStorage yourself against Redis, an encrypted DB column, or a secrets manager. See the Custom Storage guide → for a worked Redis example.
Key structure
SessionManager persists one key per signed-in account plus a small index, not one combined blob:
session:{userId} → { JSON-encoded AuthSession }
authyra_session_index → { "activeUserId": "...", "lastUpdated": "..." }
Refreshing or removing one account only touches that account's key. Data written by a version of Authyra prior to this scheme (a single authyra_session_registry blob) is migrated automatically on first load.
Authyra serialises access and refresh tokens into storage. Never use a plaintext backend,
SharedPreferences, plain browser localStorage, or an unencrypted file. Always use an encrypted store in production.