# Session kit

> Schema-driven auth state and sessions for React. It stores the tokens your backend issues and manages the session around them: restoring, refreshing, expiring, locking and syncing tabs. It never signs users in.

Each link is a page as Markdown, in the order the docs read. [llms-full.txt](https://session-kit.pages.dev/llms-full.txt) has every page in one file. They cover the newest release of `@monarcode/session-kit`.

- [Introduction](https://session-kit.pages.dev/docs/index.md): Define, validate, and manage your app's session from your backend's tokens, through reloads, expired tokens, other tabs, and outages.
- [Installation](https://session-kit.pages.dev/docs/installation.md): Install Session kit and a schema library, then find the guide and example app for your setup.
- [Getting started](https://session-kit.pages.dev/docs/getting-started.md): Build a small app that signs in, stays signed in across reloads and tabs, calls an API, and signs out.
- Setups
  - [TanStack Router](https://session-kit.pages.dev/docs/setups/tanstack-router.md): Keep the client in Router context, guard private routes before they load, and use the hooks without a provider.
  - [TanStack Start](https://session-kit.pages.dev/docs/setups/tanstack-start.md): Keep the session in an encrypted cookie with TanStack Start, so the server renders the signed-in page first.
  - [React Router](https://session-kit.pages.dev/docs/setups/react-router.md): Guard routes in React Router's declarative, data or framework mode, with the session kept in the browser.
  - [React Router with server rendering](https://session-kit.pages.dev/docs/setups/react-router-ssr.md): Keep the session in an encrypted cookie in React Router's framework mode, where middleware refreshes it and loaders read it.
  - [Next.js](https://session-kit.pages.dev/docs/setups/next.md): Keep the session in an encrypted cookie with the Next.js App Router, where Server Components read it and Proxy refreshes it.
  - [Expo Router](https://session-kit.pages.dev/docs/setups/expo.md): Save the session in the device's secure storage, hold the splash screen while it restores, and keep deep links across sign-in.
- Server rendering
  - [Overview](https://session-kit.pages.dev/docs/server-rendering.md): With server rendering, the session lives in an encrypted cookie on the server, and the first page renders signed in.
  - [Server sessions](https://session-kit.pages.dev/docs/server-rendering/server-sessions.md): How the server keeps the session in every framework, from the cookie and its secret to refreshing, signing out and limits.
  - [Hybrid setup](https://session-kit.pages.dev/docs/server-rendering/hybrid.md): Sign in with your backend from the browser and call your API there, while the server keeps the session in its cookie.
- Using the client
  - [Using the client](https://session-kit.pages.dev/docs/client.md): The client's methods at a glance, for loaders, event handlers, request code, and anything else outside React.
  - [State](https://session-kit.pages.dev/docs/client/state.md): Read the client's state outside React, follow its changes, and know what each field holds.
  - [Sessions and credentials](https://session-kit.pages.dev/docs/client/sessions.md): Ask the client who is signed in, and keep the access token apart from code that only needs the user.
  - [Signing in and out](https://session-kit.pages.dev/docs/client/signing-in-and-out.md): Save a new session, end it in every tab, and revoke the ended tokens on your backend.
  - [Updating the user](https://session-kit.pages.dev/docs/client/updating-the-user.md): Replace the signed-in user without ending the session, safely across account switches.
  - [Authenticated requests](https://session-kit.pages.dev/docs/client/requests.md): A fetch that sends the access token to one API, refreshes on a 401, and never leaks the token.
  - [Other HTTP clients](https://session-kit.pages.dev/docs/client/other-http-clients.md): Send the access token with ky, axios, openapi-fetch or any other HTTP client.
  - [Users from the access token](https://session-kit.pages.dev/docs/client/users-from-tokens.md): Read the user from a JWT access token's claims, instead of from your backend's sign-in response.
  - [Locking](https://session-kit.pages.dev/docs/client/locking.md): Restore a saved session as locked until the user unlocks it, for example with biometrics, in native apps.
- Configuring the client
  - [Configuring the client](https://session-kit.pages.dev/docs/configuration.md): Every option createAuth takes, with a page for each part of the client you can configure.
  - [User schemas](https://session-kit.pages.dev/docs/configuration/user-schemas.md): How the user schema checks every user the client accepts, and what restoring a session requires of it.
  - [Refresh](https://session-kit.pages.dev/docs/configuration/refresh.md): What the refresh callback's results mean, when a refresh runs, and why an outage never signs anyone out.
  - [Expiry](https://session-kit.pages.dev/docs/configuration/expiry.md): How the client finds out when the access token expires, and which of your backend's answers to prefer.
  - [Storage](https://session-kit.pages.dev/docs/configuration/storage.md): Where the client saves the session, from localStorage to the device's secure store or your own.
  - [Tabs](https://session-kit.pages.dev/docs/configuration/tabs.md): How open tabs follow each other's sign-ins and sign-outs, and share one refresh between them.
  - [Errors](https://session-kit.pages.dev/docs/configuration/errors.md): How Session kit's errors reach your app, how to show them to users, and the storage failures that need your decision.
  - [Debugging](https://session-kit.pages.dev/docs/configuration/debugging.md): Log what the client does, or send each event to your error reporting, without exposing tokens.
- [Effect and effetch](https://session-kit.pages.dev/docs/effect.md): Use the session as an Effect service, call your API with effetch, and cache each account's data with effetch-query.
- Reference
  - [Entry points](https://session-kit.pages.dev/docs/reference.md): Every import path Session kit publishes, and what each one exports.
  - [Core](https://session-kit.pages.dev/docs/reference/core.md): The client and storage: create one auth client per app.
  - [React](https://session-kit.pages.dev/docs/reference/react.md): React hooks and the provider that read a client's state.
  - [TanStack Router](https://session-kit.pages.dev/docs/reference/tanstack-router.md): Route guards and router wiring for TanStack Router.
  - [React Router](https://session-kit.pages.dev/docs/reference/react-router.md): Route guards and revalidation for React Router.
  - [React Router server](https://session-kit.pages.dev/docs/reference/react-router-server.md): Server sessions in React Router's framework mode.
  - [HTTP](https://session-kit.pages.dev/docs/reference/http.md): A fetch that sends the access token and refreshes on a 401.
  - [Server](https://session-kit.pages.dev/docs/reference/server.md): Sessions kept on the server, in an encrypted cookie.
  - [TanStack Start](https://session-kit.pages.dev/docs/reference/tanstack-start.md): Server sessions and hydration for TanStack Start.
  - [TanStack Start server](https://session-kit.pages.dev/docs/reference/tanstack-start-server.md): TanStack Start's server-side cookie access.
  - [Next.js](https://session-kit.pages.dev/docs/reference/next.md): Server sessions for the Next.js App Router.
  - [Expo](https://session-kit.pages.dev/docs/reference/expo.md): Secure storage, the session gate and deep links for Expo Router.
  - [Effect](https://session-kit.pages.dev/docs/reference/effect.md): The session as an Effect service.
  - [effetch](https://session-kit.pages.dev/docs/reference/effetch.md): An effetch plugin that sends the access token.
  - [Error codes](https://session-kit.pages.dev/docs/reference/error-codes.md): Every AuthErrorCode, what it means and when you'll see it.
  - [Compatibility](https://session-kit.pages.dev/docs/reference/compatibility.md): The peer dependency versions, runtimes, and TypeScript settings Session kit supports and is tested with.
- [Common questions](https://session-kit.pages.dev/docs/faq.md): Short answers about refresh tokens, expiry, storing tokens, caches, bundle size, and other ways to sign in.
- [Security](https://session-kit.pages.dev/docs/security.md): What Session kit protects, what stays your backend's job, and where tokens live in each setup.