Dart & Flutter SDK

neuctra_authix_dart_package is the official Dart SDK for Neuctra Authix. It mirrors the JavaScript SDK — the same class name, method names, routes and security model — expressed with Dart types, null safety and generics, plus Stream-based cursor traversal that suits a ListView.

Dart SDK ^3.0.0Flutter · Android · iOS · Web · DesktopOne dependency: package:http

Quick start

Dart

1import 'package:neuctra_authix_dart_package/neuctra_authix_dart_package.dart';
2
3final authix = NeuctraAuthix(
4  const NeuctraAuthixConfig(
5    appId: 'your_app_id_here',
6    publishableKey: 'pk_live_xxxxxxxx_xxxxxxxxxxxxxxxx',
7  ),
8);
9
10await authix.loginUser(
11  const LoginParams(email: '[email protected]', password: 'secret'),
12);
13
14final session = await authix.checkUserSession();
15
16// Every list is a bounded Page — 20 records by default, 100 maximum.
17final page = await authix.getUserData(
18  GetUserDataParams(userId: session.userId!, limit: 50),
19);
20
21for (final record in page) {
22  print(record['title']);
23}

What the SDK gives you

Area	Count	What it covers
Auth & users	11	Signup, login, logout, session checks, profile, update, delete, email OTP verification.
User security	3	Forgot-password OTP, password reset, existence check.
User records	9	Per-user record CRUD, search, bulk delete and atomic batches — every read cursor-paginated.
App data	7	App-wide record CRUD plus search, scoped by appId. Secret key only.
Across all users	6	List and search every user of the app and all their records. Secret key only.
Escape hatch	2	rawRequest() for unwrapped endpoints, pages() to walk any cursor-taking method.

One-to-one with the JavaScript SDK

If you already know the JavaScript SDK, you already know this one. Object literals become const parameter classes, and the wire format is identical.

Dart

1// TypeScript
2await authix.addUserData({
3  userId: "u1",
4  dataCategory: "notes",
5  data: { title: "Hello" },
6});
7
8// Dart — same method, same route, same payload
9await authix.addUserData(
10  const AddUserDataParams(
11    userId: 'u1',
12    dataCategory: 'notes',
13    data: {'title': 'Hello'},
14  ),
15);

Package layout

A single import gives you the client, the config, every parameter and response class, the exception type and the session store.

Bash

lib/
├── neuctra_authix_dart_package.dart   # single import — exports everything
└── src/
    ├── client/neuctra_authix_client.dart   # NeuctraAuthix — every method
    ├── models/config.dart                  # NeuctraAuthixConfig
    ├── models/api_key.dart                 # key parsing and masking
    ├── models/pagination.dart              # Page<T>, cursor traversal
    ├── models/params.dart                  # request objects
    ├── models/responses.dart               # DataItem, session, envelopes
    ├── http/session_store.dart             # cookie jar
    └── exceptions/…                        # the typed error hierarchy

Security model

Neuctra Authix uses two independent mechanisms, and each method uses exactly one of them. Every method in these docs is tagged with which.

Mechanism	Used by	How it works
Session cookie	End-user routes	The backend issues an HTTP-only authix_user_session cookie on signup and login. The SDK stores it and replays it on every call.
Publishable key	Client apps	pk_live_… — sent as x-api-key. Safe to ship in a Flutter build. Covers sign-up, sign-in, verification, password reset, and the signed-in user's own records.
Secret key	Server only	sk_live_… — required for app-data and across-all-users routes. Never ship this in a mobile or web build; the SDK refuses to construct a client if you pass one as publishableKey.

Record ownership is enforced for you

When a call is made with a publishable key, the server pins the target to the signed-in session. The userId in the URL is ignored, so a decompiled binary cannot be pointed at another person's records by editing an id.

A secret key may target any user by design — which is exactly why it belongs on a server.

Read this before shipping

A mobile binary can be decompiled, so anything you ship in the app is public. Only pk_live_… keys are safe there.

Keep getAllUsersFromApp, searchInAllAppUsers, and every app-data call on your own backend. They require a secret key and will return InsufficientScopeError from a Flutter build.
Never store a secret key in --dart-define, an asset, or source. Defines are compiled into the binary in plain text.

Next steps

Install the package and initialise the client.
Wire up login, signup and session persistence.
Store per-user records with the user data API.

Installation & Setup Auth & User Management User Data Management Dart Types Reference