> ## Documentation Index
> Fetch the complete documentation index at: https://docs.crxbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Authentication

> How end-user authentication works with OTP-based email login and browser sessions.

crxbase handles authentication for your extension users with a passwordless OTP (one-time password) email flow. You don't need to build any auth system.

## How it works

<Steps>
  <Step title="User opens the login page">Your extension calls `client.openLoginPage()`, which opens the crxbase login page in the browser.</Step>
  <Step title="User enters their email">The user types their email address and clicks **Sign in**.</Step>
  <Step title="OTP is sent">A 6-digit code is sent to their email. The code expires after **10 minutes**.</Step>
  <Step title="User enters the code">The user enters the 6-digit code to verify their identity.</Step>
  <Step title="Session is created">A signed-in browser session is created automatically. The session lasts **90 days**.</Step>
</Steps>

After login, all library methods (`getUser()`, etc.) work with the authenticated session.

## Session details

| Property          | Value                        |
| ----------------- | ---------------------------- |
| Session duration  | 90 days                      |
| OTP expiry        | 10 minutes                   |
| OTP request limit | 5 codes per 10 minutes/email |

## Handling expired sessions

When a session expires, `getUser()` returns `null`. Check for this and prompt the user to log in again:

```javascript theme={null}
const user = await client.getUser();

if (!user) {
	// Session expired or user not logged in
	client.openLoginPage();
	return;
}

// User is authenticated
```

## Logging out

Call `client.logout()` to clear the user's session:

```javascript theme={null}
await client.logout();
```

This ends the current session. The user will need to log in again to use authenticated features.