Skip to main content
No binding ever rejects with a bare string. Narrow the rejection with isAuthError() and switch on kind.
message is written for developers. For user-facing copy, use @exegia/use-auth — every block renders resolved messages and accepts per-kind overrides through errorMessages.

Kinds

Credentials and sign-up

Session and flow

Identities

Passkeys

Wiring

Timeouts

Every operation resolves or rejects within a 15 second network budget. A stalled request surfaces as network rather than a promise that never settles, so a spinner always has an exit. The one exception is the OS credential prompt during a passkey ceremony: no network timeout spans it, because the user decides how long it takes. The server’s challenge TTL is the effective ceiling there.

Cancellation is not an error

Two flows report user cancellation as a status rather than a rejection:
  • signInWithPasskey() and registerPasskey() resolve with { status: "cancelled" } when the OS prompt is dismissed.
  • cancelOAuthFlow() aborts a browser round-trip; the pending signInWithOAuth() call rejects with oauthFlowInterrupted, which is a return to idle rather than a failure — treat it as such in your UI.