Recipes
Copy-paste solutions to common problems — browse all recipes below.
Each recipe is a self-contained, runnable example. Pick one, copy the code, adapt the names — done.
Auth lifecycle & events
React to a new signup with UserRegisteredEventcreate your AppUser, link a referral, queue a welcome emailReact to login with UserLoggedInEventlast-login tracking, role sync, audit writesTransactional user creationwrap NestAuthUser + AppUser in one TypeORM transaction so a mid-flow failure rolls back cleanlyCustom OAuth providerextend BaseAuthProvider for an IDP that isn't built inExtra signup fields with collectProfileFieldscapture and persist your own fields at registrationLink multiple providers to one accountconnect Google, Apple, password, etc. under a single identityNormalize email & phonenormalizedEmail / normalizedPhone for consistent identity matching
Multi-tenant & multi-platform
Multi-platform login with guardsadmin / portal / mobile from one backend, with origin-aware login gatingPlatform-admin portalstaff who manage the whole platform as full users with a cross-tenant super-admin role, origin-locked and MFA-gatedTenant switchera tenant-picker dropdown that re-scopes the active sessionLogging in under a tenant (ISOLATED)slug → tenantId resolution, the login DTO, password reset, and the invite patternPer-request config (mobile vs web)vary auth behavior per incoming request
Multi-account switcher (v2.6)
Roles, permissions & access control
Seeding roles & permissionsidempotent bootstrap of isSystem roles per guardExternal role resolverresolve roles from Okta / Auth0 / a custom IDPIP allowlist guardrestrict auth via guards.beforeAuthAccount suspension and reactivationblock and restore access without deleting the accountForce password changemake admin-set temporary passwords genuinely temporary via mustChangePassword
MFA & devices
MFA recovery codesgenerate, show, and store backup codesRemember this deviceskip MFA on trusted devices using trusted-device tokensCustom trusted-device headerchange the trusted-device header name
Tokens & sessions
Frontend integration
Pre-built React auth formslogin / signup / MFA / forgot-password componentsNext.js dashboard behind <RequireRole>role-gated protected routes