Account

An account is a person who works in Arky: a store owner, a team member or a platform administrator. It is a sign-in email; store access comes from memberships. Storefront customers are a separate identity and never get accounts.

import type { EpochMilliseconds } from "arky-sdk";

interface Account {
	id: string;
	email: string;
	status: { type: "active" } | { type: "deleting" };
	created_at: EpochMilliseconds;
	updated_at: EpochMilliseconds;
}

Sign In With A Code

import { createAdmin } from "arky-sdk/admin";

const sdk = createAdmin({ apiUrl: "https://api.arky.io" });

const pending = await sdk.account.auth.requestCode({ email: "lena@example.com" });
await sdk.account.auth.verify({ session_id: pending.session_id, code: "123456" });

const me = await sdk.account.getMe();

The Arky sign-in code is one of Arky’s own emails, sent through Arky’s own Resend account from Arky’s address. The first accepted code for an email creates its account. A code lasts ten minutes, an address gets at most one new code per minute, and after five wrong tries every try for that address is refused until the code expires. With store_id, requestCode and verify sign in through a store’s own login page; a store that is closing refuses them. The Admin client keeps the session and refreshes it. Transferring a store, closing it and adding or removing a platform administrator need a sign-in within the last 15 minutes.

Sessions

A session is pending_verification (with its failed attempts and expiry), active, superseded or revoked. One session is one sign-in; finished sessions are removed after 30 days.

Integrations

There are no personal account tokens. Trusted jobs, such as seed scripts and imports, use one of a store’s secret keys, which acts with its own permissions and keeps working when the person who made it leaves the store:

const server = createAdmin({ apiUrl: "https://api.arky.io", secretKey: process.env.ARKY_SECRET_KEY });

Account

Deleting your account marks it deleting; one cleanup step then removes its sessions, its memberships and any platform administrator grant, and then the account. An account that owns an active store can’t be deleted: transfer or close the store first; a store that is being closed doesn’t stop it. The last platform administrator’s account can’t be deleted.