Authentication

Add login that connects users to their data

Email and password, OAuth with Google, GitHub, Microsoft and Apple, and guest access, with one user identity across Postgres, functions and storage.

Start building

configure-auth

$volcano cloud config pull --force# the auth block it writes out, edited to tasteauth:  signup:            { enable_signup: true, enable_anonymous_signins: true }  email_verification: { require_confirmation: true }  managed_pages:     { enabled: true }$volcano cloud config deploy✓ auth configured · hosted login and reset pages live# auth.uid() now returns a real user inside every policy

Overview

Keep each user’s data behind a login

Verifying a password is the easy part. Every query and handler after it also needs to know who is asking, and one missed check exposes another user’s data.

Volcano passes the same user ID everywhere. Postgres policies read it with auth.uid(), functions receive it as __volcano_auth, and storage policies check it against file paths. Service keys and admin database connections bypass these rules, so keep them on the server.

User identity

Use the signed-in user across your backend

Postgres policies, function handlers and storage policies all receive the same user ID. Each layer keeps its own rules, and every rule checks the same person.

Postgres policies read auth.uid()
Functions receive event.__volcano_auth.user_id and role
Storage policies check the user against a file path

one session, three checks

# access token for user 8f1c…postgres   auth.uid() → 8f1c…      12 of 1284 rowsfunction   __volcano_auth.role → authenticatedstorage    8f1c/report.pdf allowed · 9a2b/… refusedno permission code in between

Guest login

Let people try your app before signup

Give guests a user ID and session without an email or password, then convert them to permanent accounts.

Anonymous sign-in is off by default
User IDs work in row-level policies
convertAnonymous keeps the ID and associated data

Sessions

Let users sign out another device

List sessions and revoke access by device. Access tokens authenticate requests; refresh tokens renew sessions.

Access tokens default to 1 hour
Refresh token lifetime configurable from 1 hour
Refresh token reuse window defaults to 10 seconds

await volcano.auth.getSessions()

ses_91f4   macbook · safari      currentses_2c07   iphone · app          2 days agoses_74be   unknown · chrome      3 weeks ago$await volcano.auth.deleteAllOtherSessions()✓ 2 sessions revoked server-side

Capabilities

Choose your login flow

Email and password

Signup, optional email verification, password changes and reset links with configured email delivery.

Google, GitHub, Microsoft and Apple

OAuth sign-in with each provider, plus linking and unlinking on an existing account.

Guest accounts

Give guests a user ID that survives signup.

Hosted login pages

Hosted login, password reset and device approval, with replaceable HTML and CSS.

Identity in Postgres

SQL helpers expose user ID, email, role and authentication status.

Session control

List sessions, revoke one or sign out every other device.

Code

Connect sign-in to your access policies

TypeScript

import { VolcanoAuth } from '@volcano.dev/sdk';

const volcano = new VolcanoAuth({
  apiUrl: process.env.NEXT_PUBLIC_VOLCANO_API_URL!,
  anonKey: process.env.NEXT_PUBLIC_VOLCANO_ANON_KEY!,
});

const { confirmationRequired } = await volcano.auth.signUp({ email, password });
if (!confirmationRequired) {
  const { session, error } = await volcano.auth.signIn({ email, password });
}

// OAuth redirects the browser, so these return nothing useful to await.
volcano.auth.signInWithGoogle();
volcano.auth.signInWithOAuth('github');

// Start without an account, convert later, keep the same user id.
await volcano.auth.signInAnonymously();
await volcano.auth.convertAnonymous({ email, password });

const unsubscribe = volcano.auth.onAuthStateChange((user) => {
  if (!user) redirect('/login');
});

Use cases

What people build with it

same query, different users

# volcano.from('documents').select('*')ada@acme     →  14 rowsbob@globex   →   3 rowsanonymous    →   0 rowsone policy, no client-side filtering

Platform

Works with the rest of Volcano

Databases and vector

Postgres row-level security
Write table policies with built-in auth.uid() and auth.role() helpers.

Functions and agents

Functions with user context
User-token invocations include verified __volcano_auth details for your handler’s permission checks.

File storage

Files scoped to each user
Use auth.uid() in storage policies to control browser uploads and reads.

Next.js frontends

Next.js route protection
Validate sessions in middleware and redirect signed-out users before rendering protected routes.

Frequently asked questions

Read the docs

What login methods does Volcano support?

Email and password, OAuth with Google, GitHub, Microsoft and Apple, and anonymous guest sessions. Email verification and guest sign-in are optional. Magic links, SMS codes, passkeys, TOTP and SAML aren’t supported.

How do I add authentication to a Next.js app?

Use @volcano.dev/sdk for sign-in and its Next.js middleware helpers for session validation. Call withAuth in middleware and redirect to login when it returns no user.

How does authentication work with Postgres row-level security?

Volcano supplies auth.uid() to identify the user in policies on user-scoped queries. Enable RLS, then compare a record’s user_id with auth.uid() in its policy. The anon key is safe in a browser; the service key bypasses RLS and belongs on a server.

Can anonymous users sign up without losing their data?

Yes, convertAnonymous preserves the guest’s user ID and associated data. Pass an email and password to create permanent credentials.

How long do Volcano authentication tokens last?

Access tokens last one hour by default and can be set as short as 60 seconds. Refresh token lifetime is configurable, with a minimum of one hour. Refresh tokens rotate each time they’re used, except within a 10-second reuse window after issue, when the same token comes back.

Can I build my own login page?

Yes, use the Volcano SDK’s signIn and signUp methods. Or use hosted pages with replaceable HTML and CSS.

Add login to your app

Build, deploy, and scale on Volcano's global platform — free to start, with no infrastructure to manage.

Start building free

Checkout more features

← File Storage

Realtime →