API reference

The `SignIn` composable renders a full app-native sign-in form. It drives the Flow Execution API loop automatically: initiating the flow, presenting the server-defined inputs and actions on each step, and completing when the user is authenticated. `SignIn` requires `ThunderIDProvider` in its ancestor composable hierarchy.

import dev.thunderid.compose.components.presentation.auth.SignIn

@Composable
fun AuthView(applicationId: String) {
    SignIn(
        applicationId = applicationId,
        modifier = Modifier.fillMaxWidth().padding(16.dp)
    )
}

The `SignInButton` composable renders a pre-styled button that calls an `onClick` lambda when tapped. It does not initiate the sign-in flow itself. Your `onClick` handler opens the sign-in UI (e.g., showing a `SignIn` form or launching the redirect URL). `SignInButton` requires `ThunderIDProvider` in its ancestor composable hierarchy.

import dev.thunderid.compose.components.actions.SignInButton

@Composable
fun LandingView() {
    var showSignIn by remember { mutableStateOf(false) }

    SignInButton(onClick = { showSignIn = true })

    if (showSignIn) {
        SignIn(applicationId = "<your-application-id>")
    }
}

The `SignOutButton` composable renders a pre-styled button that calls `ThunderIDClient.signOut()`, then calls `ThunderIDState.refresh()` to update the reactive auth state. It disables itself automatically while the sign-out operation is in progress. `SignOutButton` requires `ThunderIDProvider` in its ancestor composable hierarchy.

import dev.thunderid.compose.components.actions.SignOutButton

@Composable
fun HomeView() {
    Column {
        Text("You are signed in.")
        SignOutButton()
    }
}

The `SignUp` composable renders a full app-native registration form. It drives the Flow Execution API loop automatically: initiating the registration flow, presenting the server-defined inputs and actions on each step, and completing when the user is registered and authenticated. `SignUp` requires `ThunderIDProvider` in its ancestor composable hierarchy.

import dev.thunderid.compose.components.presentation.auth.SignUp

@Composable
fun RegisterView() {
    SignUp(modifier = Modifier.fillMaxWidth().padding(16.dp))
}

The `SignedIn` composable conditionally renders its content only when the user is authenticated. It reads the current sign-in state from `LocalThunderID` and displays protected UI for signed-in users, while rendering optional fallback content (or nothing) when the user is not authenticated. `SignedIn` requires `ThunderIDProvider` in its ancestor composable hierarchy.

import dev.thunderid.compose.components.guards.SignedIn

@Composable
fun ContentView() {
    SignedIn {
        Text("You are signed in.")
    }
}

The `SignedOut` composable conditionally renders its content only when the user is **not** authenticated. It is the counterpart to `SignedIn`. `SignedOut` requires `ThunderIDProvider` in its ancestor composable hierarchy.

import dev.thunderid.compose.components.guards.SignedOut

@Composable
fun ContentView() {
    SignedOut {
        Text("Please sign in to continue.")
    }
}

The `UserProfile` composable renders an editable profile form. It loads the user's current profile from `/scim2/Me` when it first composes, presents editable fields for `displayName` and `phoneNumbers`, and saves changes via `ThunderIDClient.updateUserProfile`. `UserProfile` requires `ThunderIDProvider` in its ancestor composable hierarchy.

import dev.thunderid.compose.components.presentation.user.UserProfile

@OptIn(ExperimentalMaterial3Api::class)
@Composable
fun ProfileSheet(onDismiss: () -> Unit) {
    ModalBottomSheet(onDismissRequest = onDismiss) {
        UserProfile(
            modifier = Modifier.fillMaxWidth().padding(24.dp),
            onSaved = onDismiss
        )
    }
}

The `ChangeCredential` composable renders a form that lets a signed-in user set a new value for one of their own credentials. It collects only a new value and its confirmation, checks it against the applicable rules, and posts the change via `ThunderIDClient.updateUserCredentials`. It reads the rules it needs from the user type schema (`GET /users/me/meta`), fetched once and shared with any other mounted component that needs it (for example `UserProfile`), so multiple components cost one request rather than one each. The default label and messages are built from the credential attribute's own `displayName` in that schema, so they always match whatever an admin named it there. By default it manages the `password` credential. To manage a different one, for example a PIN declared on the user type schema, set `attribute = 'pin'`; render the composable once per credential to let a user manage more than one. `ChangeCredential` requires `ThunderIDProvider` in its ancestor composable hierarchy. `ChangeCredential` collects only a new value and its confirmation, not the account's existing value. The self-service credential write path does not verify the current value today, so asking for one would only teach the user a false sense of security.

import dev.thunderid.compose.components.presentation.user.ChangeCredential

@Composable
fun SecuritySection() {
    Column {
        Text("Security")
        ChangeCredential()
    }
}

`ThunderIDConfig` is the configuration data class passed to `ThunderIDClient.initialize(config, storage)` and to the `ThunderIDProvider` composable.

import dev.thunderid.android.ThunderIDConfig

val config = ThunderIDConfig(
    baseUrl = "https://localhost:8090",
    clientId = "<your-client-id>",
    scopes = listOf("openid", "profile", "email"),
    afterSignInUrl = "dev.thunderid.app://callback",
    afterSignOutUrl = "dev.thunderid.app://logout",
    applicationId = "<your-application-id>"
)

`ThunderIDClient` is the core authentication client in the `dev.thunderid:android` library. It manages the full authentication lifecycle: initialization, sign-in (both app-native and redirect-based), session, token management, and user profile operations. When you use the `dev.thunderid:compose` library, a `ThunderIDClient` instance is created and managed automatically. You can access it via `LocalThunderID.current.client` from any composable.

import dev.thunderid.android.ThunderIDClient
import dev.thunderid.android.ThunderIDConfig

val client = ThunderIDClient()

client.initialize(
    config = ThunderIDConfig(
        baseUrl = "https://localhost:8090",
        clientId = "<your-client-id>",
        scopes = listOf("openid", "profile", "email"),
        afterSignInUrl = "dev.thunderid.app://callback",
        afterSignOutUrl = "dev.thunderid.app://logout"
    )
)

`ThunderIDState` is the reactive authentication state class provided by the `dev.thunderid:compose` library. It holds the current user, loading state, and initialization status, and exposes the underlying `ThunderIDClient` for direct API calls. `ThunderIDState` is provided via `LocalThunderID`, a `CompositionLocal` injected by `ThunderIDProvider`. Any composable in the hierarchy can read it using `LocalThunderID.current`.

import androidx.activity.ComponentActivity
import androidx.activity.compose.setContent
import dev.thunderid.android.ThunderIDConfig
import dev.thunderid.compose.ThunderIDProvider

class MainActivity : ComponentActivity() {
    override fun onCreate(savedInstanceState: Bundle?) {
        super.onCreate(savedInstanceState)
        setContent {
            ThunderIDProvider(
                config = ThunderIDConfig(
                    baseUrl = "https://localhost:8090",
                    clientId = "<your-client-id>",
                    afterSignInUrl = "dev.thunderid.app://callback",
                    afterSignOutUrl = "dev.thunderid.app://logout"
                )
            ) {
                AppContent()
            }
        }
    }
}