ReadonlyisObservable that emits true if the user is authorized, otherwise false.
ReadonlykeepWhether the server is configured to keep users logged in by auto-refreshing before session expiry.
Provided by the backend via the keep-user-logged-in attribute on <umb-app>.
Readonlysession$ReadonlytimeoutObservable that acts as a signal and emits when the user has timed out, i.e. the token has expired. This can be used to show a timeout message to the user.
Observable that acts as a signal for when the authorization state changes.
An observable that emits when the authorization state changes.
Internal
Observable that emits once, without a value, when the auth context is initialized. For consumers: the boot sequence already awaits app entry points before the router evaluates its guards, so by the time any extension code runs this has long since completed.
An observable that emits once when the auth context is initialized.
The addEventListener() method of the EventTarget interface sets up a function that will be called whenever the specified event is delivered to the target.
Optionaloptions: boolean | AddEventListenerOptionsCompletes the login flow. This is called on the oauth_complete page to exchange the authorization code for tokens.
The token response timing, or null if no authorization was pending.
Configures a @hey-api/openapi-ts generated client for authenticated API calls.
Sets baseUrl, credentials, and the auth callback (cookie-based with
automatic token refresh via getLatestToken), and binds the default
response interceptors (401 retry, problem-details error notifications, etc.)
to the client.
The same auth context owns a single UmbApiInterceptorController for
the lifetime of the host (<umb-app>), so it's safe to call this method for
multiple clients (the core's umbHttpClient and an extension's own
generated client) without registering duplicate auth-signaler contexts.
A @hey-api/openapi-ts client instance — either umbHttpClient
or one regenerated by an extension package against its own OpenAPI document.
Callback method called with the resolved context instance or undefined.
Reference to the created Context Consumer Controller instance
Subscribe to a context. The callback fires when the context resolves, again if the context is replaced, and can also be invoked with undefined if the context is unprovided or the host disconnects. Use this whenever a controller or element needs the context at setup time — both for ongoing observation and for reading values immediately on resolve. This is the default choice; prefer it over getContext unless the context is only needed inside a later user action.
The dispatchEvent() method of the EventTarget sends an Event to the object, (synchronously) invoking the affected event listeners in the appropriate order.
Gets all registered auth providers.
The extension registry to query.
An observable of the registered auth providers.
Optionaloptions: UmbClassGetContextOptions
Options for resolving the context once, including timeout-related behavior such as preventTimeout.
A Promise resolving to the Context API instance when available, or undefined when applicable.
Retrieve a context once as a Promise. Use this only when the context is first needed inside a user action or event handler that runs later (for example a button click, a property action, or an entity action execute()). For setup-time access — including a single immediate read — use consumeContext instead so the controller lifecycle handles resolution and cleanup. The returned Promise may reject if the context is not found before the default timeout; callers should handle rejection and/or pass preventTimeout in the options when waiting longer is expected.
Checks if the user is authorized. If Authorization is bypassed, the user is always authorized.
True if the user is authorized, otherwise false.
Gets the latest token from the Management API. With cookie auth, this returns '[redacted]' — the real token is in the httpOnly cookie. If the session has expired, it will attempt a refresh first.
The latest token from the Management API
const token = await authContext.getLatestToken();
const result = await fetch('https://my-api.com', { headers: { Authorization: `Bearer ${token}` } });
@hey-api/openapi-ts clients.Get the default OpenAPI configuration, which is set up to communicate with the Management API.
The default OpenAPI configuration
This is useful if you want to communicate with your own resources generated by the @hey-api/openapi-ts library.
Gets the post logout redirect url.
The post logout redirect url, which is the backoffice path with the logout path appended.
Gets the authorized redirect url.
The redirect url, which is the backoffice path.
Get the server url to the Management API.
The server url to the Management API
const serverUrl = authContext.getServerUrl();
OpenAPI.BASE = serverUrl;
const config = authContext.getOpenApiConfiguration();
const result = await fetch(`${config.base}/umbraco/management/api/v1/my-resource`, {
credentials: config.credentials,
headers: { Authorization: `Bearer ${await config.token()}` },
});
Consume UMB_SERVER_CONTEXT and use its getServerUrl() — the canonical source for the server URL. Scheduled for removal in Umbraco 19.
Checks if the current session is still valid.
True if the session has not expired.
Use getIsAuthorized or observe session$ instead. Scheduled for removal in Umbraco 19.
Links the current user to the specified provider by redirecting to the link endpoint.
The provider to link to.
Initiates the login flow.
The provider to use for login. Default is 'Umbraco'.
Optionalredirect: boolean
If true, the user will be redirected to the login page.
OptionalusernameHint: string
The username hint to use for login.
Optionalmanifest: ManifestAuthProvider
The manifest for the registered provider.
Attempts to refresh the token using Web Locks to prevent concurrent refresh requests.
True if the refresh was successful, otherwise false.
An Observable to observe from.
Optionalcallback: ObserverCallback<UmbObserverValueType<ObservableType>>
Callback method called when data is changed.
OptionalcontrollerAlias: UmbControllerAlias | null
Define an explicit controller alias. If not defined then one will be generated based on the callback function. If null is parsed no controller alias will be given.
Reference to the created Observer Controller instance.
The API instance to be exposed.
Reference to the created Context Provider Controller instance
The removeEventListener() method of the EventTarget interface removes an event listener previously registered with EventTarget.addEventListener() from the target.
Optionaloptions: boolean | EventListenerOptionsInternal
Sets the auth context as initialized, which means that the auth context is ready to be used. No code outside Umbraco core should ever call this — doing so opens the provider-discovery gate early.
Sets the initial state of the auth flow. First asks existing tabs for their session via BroadcastChannel. If no peer responds, falls back to a server refresh.
Unlinks the current user from the specified provider.
The login provider to unlink from.
The provider's key for the current user.
True if the unlink succeeded.
Forces a token refresh against the server (calls /token) and returns true if successful.
Use this when you need to unconditionally refresh — e.g. session timeout keep-alive.
For per-request token handling, prefer configureClient which skips the network
call when the access token is still valid.
Uses Web Locks to deduplicate concurrent refresh requests across tabs.
True if the refresh succeeded, otherwise false
This base provides the necessary for a class to become a context-api controller.