Configure authentication

Use a server-side API key

1import { createClient } from "@qentrah/sdk";
2 
3const cms = createClient({
4  url: "https://cms.example.com",
5  apiKey: process.env.QENTRAH_API_KEY,
6});
7const health = await cms.system.health();

The API key is an application secret. Keep privileged keys in server code. The client also accepts token, optional tenant, custom headers, and an injected fetch function.

Sign in with credentials

1const cms = createClient({ url: "https://cms.example.com" });
2const session = await cms.auth.login({
3  email: "editor@example.com",
4  password: suppliedPassword,
5});

suppliedPassword is application input, not a hard-coded sample password. Login returns a token and user record. The client’s auth resource updates its authentication state; your application owns secure persistence and session lifetime.

Replace client credentials

1cms.setToken(savedToken);
2cms.setApiKey(serverApiKey);

Resource operations may also accept a per-request RequestAuth object containing apiKey or token. Apply server permissions as well as UI restrictions.

Sign out

1await cms.auth.logout();

Clear the corresponding application session and cached privileged data according to your host application’s authentication design.