User Authentication

PocketBase ships with a complete authentication system out of the box: email/password login, OAuth2 providers (Google, GitHub, and more), email verification, and password reset — no extra services required.

Auth collections

Users live in auth collections. Every instance starts with a built-in users collection, and you can create additional ones (e.g., staff) if you need separate user types.

Email / password auth

Register a user

await pb.collection("users").create({
  email: "ada@example.com",
  password: "s3cr3t-password",
  passwordConfirm: "s3cr3t-password",
});

Log in

const authData = await pb
  .collection("users")
  .authWithPassword("ada@example.com", "s3cr3t-password");

console.log(pb.authStore.isValid); // true
console.log(pb.authStore.token);   // JWT
console.log(pb.authStore.record);  // the user record

The SDK stores the token in pb.authStore (backed by localStorage in the browser) and automatically sends it with every subsequent request.

Log out

pb.authStore.clear();

Using the portal

Open your instance’s admin panel at https://<instance-name>.pocketbasecloud.com/_/
Go to Collections → users → Options → OAuth2
Enable a provider and paste in its client ID and secret

Using the CLI

pb use https://<instance-name>.pocketbasecloud.com
pb login

pb auth users config    # show authRule, oauth2, passwordAuth, mfa, otp, …

pb auth users config --set 'oauth2={"enabled":true,"providers":[
  {"name":"google",
   "clientId":"<GOOGLE_CLIENT_ID>.apps.googleusercontent.com",
   "clientSecret":"<GOOGLE_CLIENT_SECRET>"}]}'

--set replaces that field entirely. To add a second provider, run pb auth users config first and include every provider you want to keep in the JSON you send — otherwise the ones you omit are removed.

The same command edits the rest of the collection’s auth settings — for example, turning password login off once OAuth2 works:

pb auth users config --set 'passwordAuth={"enabled":false}'

Then in your app the whole flow is one call:

const authData = await pb
  .collection("users")
  .authWithOAuth2({ provider: "google" });

PocketBase opens the provider’s consent screen, handles the redirect, and creates the user record on first login.

Tip: when registering the OAuth app with the provider, use https://<instance-name>.pocketbasecloud.com/api/oauth2-redirect as the redirect URL.

Email verification and password reset

PocketBase generates the verification and reset flows for you:

// send a verification email
await pb.collection("users").requestVerification("ada@example.com");

// send a password reset email
await pb.collection("users").requestPasswordReset("ada@example.com");

Email templates and the sender address can be customized in the admin panel under Settings → Mail settings, or from the terminal:

pb settings mail                        # current SMTP config
pb settings mail set '<json>'
pb settings mail test you@example.com   # send a test message

The verification and reset templates live on the auth collection itself, so they’re edited with pb auth users config --set 'verificationTemplate={…}'.

Protecting data per user

Combine auth with API rules to scope records to their owner. A common pattern is an owner relation field on the collection with rules like:

@request.auth.id != "" && owner = @request.auth.id