# Configuring the client (https://session-kit.pages.dev/docs/configuration)

`createAuth` builds the client from a few options. This section explains each
one, for when the defaults in [Getting started](https://session-kit.pages.dev/docs/getting-started) no
longer fit your app.

## Options

`createAuth` takes three required options and five optional ones:

| Option    | Required | What it sets                                                                                                                        |
| --------- | -------- | ----------------------------------------------------------------------------------------------------------------------------------- |
| `name`    | Yes      | Names the saved session and the refresh lock: letters, digits, `_` or `-`, up to 64 characters. Keeps two apps on one origin apart. |
| `user`    | Yes      | A [user schema](https://session-kit.pages.dev/docs/configuration/user-schemas), or [`fromAccessToken`](https://session-kit.pages.dev/docs/client/users-from-tokens).                          |
| `storage` | Yes      | [Where the session is saved](https://session-kit.pages.dev/docs/configuration/storage).                                                                          |
| `refresh` | No       | [How to get new tokens](https://session-kit.pages.dev/docs/configuration/refresh). Without it, an expired token signs the user out.                              |
| `revoke`  | No       | [Revokes the ended tokens](https://session-kit.pages.dev/docs/client/signing-in-and-out) on your backend after a sign-out.                                       |
| `maxAge`  | No       | How long a saved session can be restored, in seconds. Default: 30 days, counted again from each save.                               |
| `debug`   | No       | [Reports what the client does](https://session-kit.pages.dev/docs/configuration/debugging). Default: off.                                                        |
| `locking` | No       | [Restores a saved session as `locked`](https://session-kit.pages.dev/docs/client/locking), for native apps. Default: off.                                        |

`createAuth` throws an `AuthError` with the code `INVALID_OPTIONS` for an
option it can't use, such as a `name` with other characters, or a `maxAge`
that isn't a positive whole number.

## Pages in this section

Each page covers one part of the client: how it checks users, gets new
tokens, saves the session, follows other tabs, and reports what happens.

- [User schemas](https://session-kit.pages.dev/docs/configuration/user-schemas): When the schema checks users, and the rules restoring a session sets for it.

- [Refresh](https://session-kit.pages.dev/docs/configuration/refresh): What the refresh callback returns, and when a refresh runs.

- [Expiry](https://session-kit.pages.dev/docs/configuration/expiry): How the client finds out when the access token expires.

- [Storage](https://session-kit.pages.dev/docs/configuration/storage): Where the session is saved: localStorage, sessionStorage, the device, or your own store.

- [Tabs](https://session-kit.pages.dev/docs/configuration/tabs): How tabs follow each other's sign-ins, and share one refresh.

- [Errors](https://session-kit.pages.dev/docs/configuration/errors): How errors reach your app, and the failures that need a decision from you.

- [Debugging](https://session-kit.pages.dev/docs/configuration/debugging): Log what the client does, or send it to your error reporting.