# @zyphr-dev/auth-react

React bindings for [Zyphr](https://zyphr.dev) auth. Wrap your app once and get a
reactive session with automatic, proactive token refresh — no token-lifecycle
plumbing to write.

- `<ZyphrAuthProvider>` — provides the session to your tree.
- `useSession()` — reactive `{ status, accessToken, isAuthenticated }`.
- `useAuth()` — `login`, `logout`, `refresh`.

Built on [`@zyphr-dev/auth-core`](https://zyphr.dev/docs/sdks/auth) and the
client-safe `ZyphrClient` (publishable key — no secret in the browser).

## Install

```bash
npm i @zyphr-dev/auth-react @zyphr-dev/node-sdk react
```

## Usage

```tsx
import { ZyphrClient } from '@zyphr-dev/node-sdk';
import { ZyphrAuthProvider, useSession, useAuth } from '@zyphr-dev/auth-react';

const client = new ZyphrClient({ applicationKey: 'za_pub_xxx' });

function App() {
  return (
    <ZyphrAuthProvider client={client}>
      <Screen />
    </ZyphrAuthProvider>
  );
}

function Screen() {
  const { status, isAuthenticated } = useSession();
  const { login, logout } = useAuth();

  if (status === 'loading') return <p>Loading…</p>;
  if (!isAuthenticated) {
    return <button onClick={() => login({ email, password })}>Sign in</button>;
  }
  return <button onClick={() => logout()}>Sign out</button>;
}
```

The access token is available from `useSession().accessToken` for authenticated
API calls.

## Token storage

By default tokens are stored in `localStorage`, with an in-memory fallback when
it isn't available (SSR, privacy modes).

`localStorage` is readable by any script on the page (an XSS risk). For the
strongest posture, proxy auth through your own backend and keep the refresh token
in an httpOnly cookie. To use a different store, pass one:

```tsx
import type { TokenStorage } from '@zyphr-dev/auth-react';

const storage: TokenStorage = { getItem, setItem, removeItem };

<ZyphrAuthProvider client={client} storage={storage}>…</ZyphrAuthProvider>
```

For React Native, use [`@zyphr-dev/auth-react-native`](https://zyphr.dev/docs/sdks/auth),
which ships a secure-storage adapter.