Logging in and logging out

Bridge auth is JWT-based. Signing in gets the browser a token set (accessToken, refreshToken, idToken), stored in localStorage. Everything else (staying signed in across reloads, staying signed in across tabs, silently refreshing before expiry) follows from that one fact.

How logging in works

On every app load, the SDK looks in localStorage for a stored token. That check is what decides whether the user sees the app or the login flow:

• A token is there: the app starts as authenticated immediately (no round-trip to check it first), then quietly schedules a refresh in the background if the token is close to expiring, so it’s valid again before you’d ever notice. This is why reloading the page doesn’t bounce a signed-in user back to the login page.
• No token is there: authState starts at 'unauthenticated' and the login flow takes over, whichever sign-in methods you’ve enabled (e.g. email & password or magic link; see the Authentication overview for all of them, and Auth states for the states the flow moves through).

If a refresh ever fails (the refresh token itself has expired or been revoked), Bridge clears the stored token and drops the user back to 'unauthenticated', the same as an explicit logout.

Logging out

Logging out is just erasing the stored token. There’s no server-side session to invalidate first, since JWTs aren’t revocable server-side the way a session cookie is:

'use client';
import { getBridgeAuth } from '@nebulr-group/bridge-nextjs/client';

export function LogoutButton() {
  async function handleLogout() {
    await getBridgeAuth().logout({ redirectTo: '/' });
  }

  return <button onClick={handleLogout}>Log out</button>;
}

logout() clears the token from localStorage, flips authState back to 'unauthenticated', and then redirects the browser:

• With redirectTo: the browser goes straight there (an in-app route, like the example above, or any URL of your choosing).
• Without it: the browser is sent to Bridge’s hosted login page instead, so the user lands somewhere sensible rather than on a blank logged-out app.

Framework note: if your app uses the hosted-login flow with withBridgeAuth middleware, a second copy of the session lives in cookies (written by the OAuth callback route so middleware.ts and Server Components can check auth). Clear those too on logout so a stale cookie doesn’t keep passing server-side checks:

// app/auth/logout/route.ts
import { NextResponse } from 'next/server';
import { TokenServiceServer } from '@nebulr-group/bridge-nextjs/server';

export async function GET(request: Request) {
  const response = NextResponse.redirect(new URL('/', request.url));
  TokenServiceServer.getInstance().clearTokensServer(response);
  return response;
}