Keep admin credentials on the server
Admin operations must run in trusted code. Never expose the team API key or another privileged authorization credential in a browser bundle.
Pass the team API secret when initializing the SDK in trusted server-side code. The SDK attaches it automatically to admin requests.
import { Jupiter } from '@jupiter-cloud/sdk' const teamApiSecret = process.env.JUPITER_TEAM_API_SECRET! const adminClient = new Jupiter( 'https://api.jupitercloud.co', 'project-id', teamApiSecret)Invite and create users
invitNewUser sends an invitation email and accepts optional user attributes and a redirect target. createUser creates a user directly and can mark an email or phone number as confirmed.
const invitation = await adminClient.auth.admin.invitNewUser( 'user@example.com', { plan: 'pro' }, { redirectTo: 'https://app.example.com/accept-invite' }) const created = await adminClient.auth.admin.createUser({ email: 'admin-created@example.com', password: 'password123', email_confirm: true, attributes: { plan: 'pro' }})The current SDK method is spelled invitNewUser.
List and retrieve users
listUsers accepts page and perPage values and returns users with pagination metadata. getUserById retrieves one user by UUID.
const { data, error } = await adminClient.auth.admin.listUsers({ page: 1, perPage: 50}) const user = await adminClient.auth.admin.getUserById(userId)Update and delete users
updateUserById changes the supplied user attributes. deleteUser accepts a second boolean argument that selects soft deletion when true.
await adminClient.auth.admin.updateUserById(userId, { attributes: { plan: 'enterprise' }}) await adminClient.auth.admin.deleteUser(userId, true)Administer MFA factors
The admin MFA namespace lists or deletes factors for a user identified by userId.
const factors = await adminClient.auth.admin.mfa.listFactors({ userId}) await adminClient.auth.admin.mfa.deleteFactor({ userId, id: factorId})Revoke sessions with an access token
The admin signOut method accepts a user access token and one of the global, local, or others targets.
const result = await adminClient.auth.admin.signOut( userAccessToken, 'global') if (result.error) { throw result.error}