API reference

Kinde API reference

Kinde auth and access control

Identifiers: 103
With full guides: 63
Types: 7

Topics covered

Setup
Login flows
Permissions & roles
Feature flags
Organizations
Tokens
Webhooks
Next.js SDK

Component

Name	What it does
`KindeProvider`	KindeProvider configures the Kinde React SDK and supplies authentication context to the application tree. Set the client, domain, redirect URIs, and optionally an API audience or scope.
`LoginLink`	`LoginLink` is a Kinde React SDK component that starts sign-in when activated. Render it with the content users should click.
`LogoutLink`	LogoutLink is Kinde’s React component for ending the current user session. Render it with child content such as a “Sign out” label.
`RegisterLink`	RegisterLink is a Kinde Next.js component for starting user registration. Render it with link content, and optionally provide orgCode to target a specific organization.
`CreateOrgLink`	CreateOrgLink is a Next.js App Router SDK component for starting organization creation. It redirects the user to Kinde and creates the organization with that user as a member.

Function

Name	What it does
`getKindeServerSession`	getKindeServerSession provides server-side Kinde authentication data in Next.js App Router server components. Use its returned methods to check authentication and retrieve user, authorization, organization, or token information.
`getUser`	`getUser()` returns the current user’s profile from the Kinde JavaScript client. Its result is a `KindeUser`, with profile fields typed as `string \| undefined`.
`getPermissions`	getPermissions asynchronously returns all permissions for the current user in the organization they are signed in to. The result includes the organization code and an array of permission keys.
`getRoles`	getRoles asynchronously returns the current user's roles as an array of Role objects. It requires the roles claim to be enabled in the application's token settings.
`getBooleanFlag`	Function
`getStringFlag`	Retrieves a string feature flag from the user's access token. An optional string fallback handles a flag that is not found.
`getOrganization`	Retrieves details for the organization associated with the signed-in user. In the TypeScript SDK, it is called with a session manager and returns an object containing the organization code.
`getUserOrganizations`	Retrieves an array of every organization the authenticated user can access. In the React SDK, call it from useKindeAuth() and await the result.
`refreshTokens`	Function
`getClaim`	getClaim asynchronously retrieves one named claim from the current access or ID token. It reads the access token by default, or the ID token when passed idToken.
`getAccessToken`	getAccessToken() asynchronously reads Kinde’s cached raw access-token JWT for use in API requests. It does not refresh the token and can return undefined or an expired token.
`isAuthenticated`	isAuthenticated checks whether the current Kinde session represents an authenticated user. In a Next.js server component, call it through getKindeServerSession and await the boolean result.
`handleAuth`	`handleAuth()` creates the Next.js route handler for Kinde authentication endpoints. In the App Router, export it as the route’s `GET` handler from `app/api/auth/[kindeAuth]/route.ts`.
`authMiddleware`	Function
`withAuth`	Function

Hook

Name	What it does
`useKindeAuth`	useKindeAuth provides Kinde authentication data inside a component. Use it to read authorized-user information or obtain an access token for protected API requests.
`useKindeBrowserClient`	A client-component hook for reading an authorized user’s Kinde authentication data in Next.js. It also provides helpers for organizations, permissions, and refreshing data.

Type Alias

Name	What it does
`KindeUser`	Type Alias
`KindeOrganization`	Type Alias
`KindePermission`	Type Alias
`KindeFlag`	Type Alias
`KindeAccessToken`	Type Alias
`KindeIdToken`	Type Alias
`SessionManager`	SessionManager is the Kinde TypeScript SDK interface for storing authentication-session data. Implement it with a key-value store and pass the adapter to SDK authentication methods.

Const

Name	What it does
`PKCE`	PKCE is Kinde’s secure Authorization Code variant for public clients such as SPAs and mobile apps. It replaces a stored client secret with a verifier-and-challenge proof.
`Audience`	Const
`Scopes`	Kinde OAuth scopes specify the protected user information or offline capability an application requests. Standard values include `openid`, `email`, `profile`, and `offline`.
`Connections`	Const
`M2M tokens`	M2M tokens are OAuth 2.0 access tokens for backend services, scripts, and automation that operate without a user. Kinde issues them through the client credentials flow for an API audience, with optional scopes and organization context.
`Custom claims`	Custom claims let Kinde workflows add application-specific data to access or ID tokens. They can also be supplied through public properties or token customization.
`Feature flags`	Kinde feature flags control feature visibility or behavior for selected users, organizations, environments, or the whole application. They use typed values and can be inherited or overridden at supported scopes.
`Multi-tenancy`	Kinde models multi-tenancy with organizations: one Kinde business can serve multiple customers while separating their users, access, and tenant data. Use a flat organization set within a business; separate Kinde businesses are required for independent projects.
`Organizations`	Organizations group Kinde users into business or tenant-like units such as companies or departments. Users may belong to multiple organizations, with roles and permissions that can differ by organization.
`Roles and permissions`	Const
`Webhooks`	Kinde webhooks notify your application when configured account events occur. Kinde sends event data in a JWT to your registered endpoint, which should verify, process, and acknowledge the request with HTTP 200.
`Custom domains`	Kinde custom domains let a production environment use your own authentication URL instead of its Kinde subdomain. Add the domain in environment settings, publish Kinde’s CNAME records, then update the application’s issuer and redirect URLs.
`Branding`	Kinde global brand defaults customize Kinde-hosted authentication pages with your business identity. Configure them in the dashboard; changes apply immediately without redeploying application code.
`MFA`	MFA requires users to prove their identity with at least two authentication factors. Kinde lets you make MFA mandatory or optional and supports email, SMS, and authenticator-app verification.
`Passwordless`	Kinde Passwordless authentication lets users sign in without maintaining passwords, using one-time passcodes delivered through configured email, phone, or username connections. Codes expire after two hours.
`Social connections`	Social connections let users sign up and sign in with existing social-account credentials. Configure a provider in Kinde’s Authentication settings, then enable it for the applications that should offer it.
`Enterprise SSO`	Const
`SAML`	SAML is an authentication protocol for Kinde enterprise connections. Kinde acts as the service provider, while an external identity provider authenticates users; the Entity ID identifies the connection and must match on both sides.
`Token customization`	Kinde token customization lets you add preset claims and properties to application tokens. Configure it per application for access, ID, or M2M tokens in the Kinde dashboard.
`OIDC`	Const
`Events API`	Const
`Property API`	Const
`Self-serve portal`	Kinde’s self-serve portal lets authorized users and organization members manage configured account functions without contacting support. Configure its available capabilities, return URL, and permissions, then open it with a one-time link.
`Billing`	Const
`Entitlements`	`Entitlements` are billing-plan capabilities that describe what a customer is allowed to use. Kinde SDK helpers can read all entitlements, retrieve one by key, or check billing-entitlement membership for a user.
`Plans`	Const
`Meters`	Const
`Agreements`	Const
`MFA enforcement`	Kinde lets administrators make MFA mandatory or optional for users. Environment settings apply globally, while organization-level settings can narrow enforcement to one organization.
`Custom properties`	Custom properties are user-defined fields for Kinde users, organizations, and applications. They store business-specific data and can be exposed in tokens as custom claims when configured as public.
`Pre-registration workflow`	Kinde’s `user:pre_registration` workflow runs after single-factor authentication and before a user record is created. Use it to validate registration inputs or block risky sign-ups.
`Post-authentication workflow`	The `user:post_authentication` workflow runs after single-factor authentication. Use it for post-login checks, user enrichment, organization assignment, and first-time-user handling before authorization continues.
`Token customization workflow`	Const
`M2M application`	An M2M application authenticates backend services, scripts, or automation tools without a user. It uses OAuth 2.0 client credentials to obtain access tokens for Kinde APIs or your own APIs.
`First-party application`	A first-party application is an OAuth application for your own product, managed under Kinde’s Customer identity area. It lets product code receive access tokens through OAuth 2.0.
`Third-party application`	Const
`Connected apps`	Kinde connected apps let users access third-party services through Kinde. Configure a provider with credentials, callback URLs, a code-facing reference key, and selected scopes.
`Dashboard`	Const
`Sign-in policies`	Const
`Session management`	Kinde session management configures application-level SSO cookie persistence and inactivity re-authentication. Backends can also terminate a user’s sessions through the Management API.

Module

Name	What it does
`getPermission`	Checks whether the current user has a specified permission in the active organization. It returns the permission key, organization code, and a boolean access result.
`getClaimValue`	getClaimValue extracts the value of a named claim from the current session's access or ID token. It defaults to the access token unless you provide id_token.
`getFlag`	Module
`getIntegerFlag`	Gets an integer feature flag for the current Kinde session. A numeric default can be supplied for an unset flag.
`getAccessTokenRaw`	getAccessTokenRaw asynchronously retrieves the raw access token through the Next.js App Router server-session API. Use it when server-side code needs the token value itself.
`getIdToken`	getIdToken asynchronously returns Kinde’s raw ID token from memory. It accepts no arguments and may resolve to undefined when no ID token is available.
`getToken`	Module
`login`	Kinde's TypeScript SDK `login` method creates a redirect URL for sign-in. Call it from a login route and redirect the browser to the returned URL.
`register`	The Kinde TypeScript SDK `register` method creates a redirect URL for hosted user sign-up. Expose it through an application route and redirect the browser to the returned URL.
`logout`	The TypeScript SDK’s `logout` method creates a Kinde logout URL from a session manager. Redirect the user to that URL to complete sign-out and return them to the configured post-logout destination.
`createOrg`	Module
`Users API`	Module
`Organizations API`	Module
`Roles API`	The Roles API lets applications manage Kinde roles and their organization-user assignments through the Management API. Roles package permissions into reusable groups, with access controlled by dedicated M2M token scopes.
`Permissions API`	Module
`Feature Flags API`	Kinde’s Feature Flags API lets authenticated machine-to-machine clients create, edit, override, and delete feature flags through the Management API. API-created flags support string, integer, and boolean types; JSON flags must be created in the dashboard.
`Connections API`	Module
`Applications API`	Kinde applications are OAuth 2.0 clients that receive access tokens for application code. Select the application type that matches the client, then authorize APIs and request their audience when API access is required.
`Business API`	Module
`Subscribers API`	Module
`APIs API`	Kinde API registration gives an API a name and unique audience, then lets you authorize applications to use it. A linked API can be included in access-token audience claims for backend authentication.
`getUserProfile`	getUserProfile asynchronously returns the profile of the currently logged-in user in Kinde’s React SDK. Obtain it from useKindeAuth and call it without arguments.
`getUserProperties`	Module
`getUserProperty`	Module
`setUserProperty`	Module
`getEntitlements`	Module
`getEntitlement`	Module
`generatePortalUrl`	generatePortalUrl creates a URL for the Kinde portal. In the React SDK, await the result and navigate to its url value, optionally supplying a return path.

Pipe

Name	What it does
`KINDE_SITE_URL`	Pipe
`KINDE_ISSUER_URL`	KINDE_ISSUER_URL stores the HTTPS domain of the Kinde tenant that issues tokens. Backend SDKs or JWT validators use it to verify that tokens come from the expected issuer.
`KINDE_CLIENT_ID`	KINDE_CLIENT_ID is the environment variable for your Kinde application’s unique Client ID. Find it on the application details page and provide it to the SDK configuration.
`KINDE_CLIENT_SECRET`	KINDE_CLIENT_SECRET stores the confidential secret issued for a Kinde application. Configure it in environment settings for back-end or M2M authentication, and keep it out of source control and client-side code.
`KINDE_POST_LOGIN_REDIRECT_URL`	KINDE_POST_LOGIN_REDIRECT_URL is an environment variable that sets where users go after authenticating. The Next.js App Router SDK also supports a per-login destination through `post_login_redirect_url` or `postLoginRedirectURL`.
`KINDE_POST_LOGOUT_REDIRECT_URL`	KINDE_POST_LOGOUT_REDIRECT_URL is the Kinde environment variable for the URL users should reach after signing out. Register the same URL as an allowed logout redirect URL in Kinde.

Search across every package and filter by type in your dashboard.

Start learning