Identity

Identity & User Model Specification

Defines the standard user, account, and session data models for ObjectStack. These schemas represent "who is logged in" and their associated data.

This is separate from authentication configuration (auth.zod.ts) which defines "how to login".

Source: packages/spec/src/identity/identity.zod.ts

TypeScript Usage

import { AccountSchema, ApiKeySchema, UserSchema, VerificationTokenSchema } from '@objectstack/spec/identity';
import type { Account, ApiKey, User, VerificationToken } from '@objectstack/spec/identity';

// Validate data
const result = AccountSchema.parse(data);

Account

Properties

Property	Type	Required	Description
id	`string`	✅	Unique account identifier
userId	`string`	✅	Associated user ID
type	`Enum<'oauth' \| 'oidc' \| 'email' \| 'credentials' \| 'saml' \| 'ldap'>`	✅	Account type
provider	`string`	✅	Provider name
providerAccountId	`string`	✅	Provider account ID
refreshToken	`string`	optional	OAuth refresh token
accessToken	`string`	optional	OAuth access token
expiresAt	`number`	optional	Token expiry timestamp (Unix)
tokenType	`string`	optional	OAuth token type
scope	`string`	optional	OAuth scope
idToken	`string`	optional	OAuth ID token
sessionState	`string`	optional	Session state
createdAt	`string`	✅	Account creation timestamp
updatedAt	`string`	✅	Last update timestamp

ApiKey

Properties

Property	Type	Required	Description
id	`string`	✅	API key identifier
name	`string`	✅	API key display name
start	`string`	optional	Key prefix for identification
prefix	`string`	optional	Custom key prefix
userId	`string`	✅	Owner user ID
organizationId	`string`	optional	Scoped organization ID
expiresAt	`string`	optional	Expiration timestamp
createdAt	`string`	✅	Creation timestamp
updatedAt	`string`	✅	Last update timestamp
lastUsedAt	`string`	optional	Last used timestamp
lastRefetchAt	`string`	optional	Last refetch timestamp
enabled	`boolean`	✅	Whether the key is active
rateLimitEnabled	`boolean`	optional	Whether rate limiting is enabled
rateLimitTimeWindow	`integer`	optional	Rate limit window (ms)
rateLimitMax	`integer`	optional	Max requests per window
remaining	`integer`	optional	Remaining requests
permissions	`Record<string, boolean>`	optional	Granular permission flags
scopes	`string[]`	optional	High-level access scopes
metadata	`Record<string, any>`	optional	Custom metadata

User

Properties

Property	Type	Required	Description
id	`string`	✅	Unique user identifier
email	`string`	✅	User email address
emailVerified	`boolean`	✅	Whether email is verified
name	`string`	optional	User display name
image	`string`	optional	Profile image URL
createdAt	`string`	✅	Account creation timestamp
updatedAt	`string`	✅	Last update timestamp

VerificationToken

Properties

Property	Type	Required	Description
identifier	`string`	✅	Token identifier (email or phone)
token	`string`	✅	Verification token
expires	`string`	✅	Token expiry timestamp
createdAt	`string`	✅	Token creation timestamp

On this page