# Using the client (https://session-kit.pages.dev/docs/client)

This section is for code outside React components. Components read the
session with hooks. Everything else, such as loaders, event handlers, and
request code, calls the client that `createAuth` returned. These are its
methods:

| Call                                              | What it does                                                                                  |
| ------------------------------------------------- | --------------------------------------------------------------------------------------------- |
| `auth.state.get()`, `.subscribe()`                | Reads the [state](https://session-kit.pages.dev/docs/client/state), or follows its changes.                                |
| `auth.getSession()`                               | Resolves who is signed in, restoring or refreshing first, or `null`.                          |
| `auth.signIn({ ...tokens, user })`                | Saves a new session, replacing any current one.                                               |
| `auth.signOut()`                                  | Ends the session, clears storage, and tells other tabs.                                       |
| `auth.updateUser(user)`                           | Replaces the user and keeps the session.                                                      |
| `auth.refresh()`                                  | Refreshes now, even while the access token is usable.                                         |
| `auth.retry()`                                    | Tries again after a failed refresh.                                                           |
| `auth.isCurrent(session)`                         | Tells whether a session is still the signed-in one.                                           |
| `auth.credentials.get()`, `.renew()`, `.reject()` | Resolves the access token, and replaces or ends it after a 401, for code that sends requests. |
| `auth.lock()`, `auth.unlock()`                    | Locks and unlocks a saved session, with [`locking`](https://session-kit.pages.dev/docs/client/locking).                    |
| `auth.mount()`                                    | Starts timers and tab sync. `AuthProvider` and the routers call it.                           |

Each method's JSDoc says what it resolves and which `AuthError` it rejects
with, so your editor shows the details where you use them.

With server rendering, the browser's client comes from `createMirrorAuth`. It
has the same state, `getSession`, `signOut`, `isCurrent` and `credentials`,
but no `lock`, `unlock` or `updateUser`. See
[Server rendering](https://session-kit.pages.dev/docs/server-rendering).

The examples in this section build on the app from
[Getting started](https://session-kit.pages.dev/docs/getting-started). `auth` is its client, and
`authFetch` its `fetch`.

- [State](https://session-kit.pages.dev/docs/client/state): Read the state outside React, and what each field holds.

- [Sessions and credentials](https://session-kit.pages.dev/docs/client/sessions): Ask who is signed in, and keep the access token apart from the user.

- [Signing in and out](https://session-kit.pages.dev/docs/client/signing-in-and-out): Save a new session, end it, and revoke its tokens.

- [Updating the user](https://session-kit.pages.dev/docs/client/updating-the-user): Replace the user without ending the session.

- [Authenticated requests](https://session-kit.pages.dev/docs/client/requests): A fetch that sends the access token to one API, and refreshes on a 401.

- [Other HTTP clients](https://session-kit.pages.dev/docs/client/other-http-clients): Send the access token with ky, axios, openapi-fetch or any other client.

- [Users from the access token](https://session-kit.pages.dev/docs/client/users-from-tokens): Read the user from a JWT's claims instead of the sign-in response.

- [Locking](https://session-kit.pages.dev/docs/client/locking): Ask a returning user to unlock, for example with biometrics, in native apps.