Custom Authentication Function

Docs

For more control, use a custom authentication function:


const bshEngine = new BshEngine({
  host: 'https://your-instance.com',
  authFn: async () => {
    const token = localStorage.getItem('accessToken');
    if (!token) return null;
    return { type: 'JWT', token };
  },
  refreshTokenFn: async () => localStorage.getItem('refreshToken'),
  onTokenRefreshed: async (accessToken) => {
    localStorage.setItem('accessToken', accessToken);
  },
});

This allows you to dynamically retrieve tokens from any storage mechanism (localStorage, sessionStorage, secure storage, etc.).

When the dashboard or your SPA logs in through the engine, session cookies are set automatically. For those clients you can omit authFn and rely on cookies:


const bshEngine = new BshEngine({
  host: 'https://your-instance.com',
  // no authFn — cookies authenticate the session
});

The default HTTP client uses credentials: 'include' so cookies are sent cross-origin when CORS allows it. For mutating requests, the SDK reads the XSRF-TOKEN cookie and sends X-XSRF-TOKEN.

If you provide a custom clientFn, pass credentials: 'include' in your fetch options when using cookie auth.

Custom Authentication Function

Docs

Cookie sessions

Types