@kerne/react manages session state (login, token refresh) and gives you hooks/components to gate UI on entitlements - it never holds a secret key, and never touches the catalog.
Installation
Initialization
KerneProvider only ever takes appId - never a secret key. Session refresh is automatic (autoRefresh, default true) - see Session.
Core hooks
useAuth()- the logged-in user, and every auth action (login/register/logout/password/verification). AlsoredirectWithSession(url), for handing the session back to your app from Kerne’s hosted auth origin - see Handoff. See Login.useAuthConfig()- the tenant’s public auth config (enable_credentials,enable_magic_link,registration_mode, branding). The prebuilt forms read it to decide what to render; a custom auth UI must read the same thing. See Auth config.useAccess(featureKey)-{ allowed, details, isLoading, error }for one feature, already scoped to the logged-in user (no need to pass one).allowedis the go/no-go;detailscarries the detail (limit/used/remaining/overage_behavior) when you want to show how much is left. One request either way. See Check an entitlement.useEntitlements()- the whole entitlement list for a “your plan” screen. It has no per-featureallowedfield (the list is cached) - never gate on it; useuseAccessfor that. See List entitlements.useCheckout()/usePortal()- start a checkout session, or open the billing portal. Redirect flows only. See Checkout & portal.useSubscription()/useUser()- reactive reads of the caller’s own subscription/profile.useClient()- the underlyingKerneClientinstance, for anything not covered by the hooks above.
Gating a feature
The guard components (<Access>, <Authenticated>, <Protected>, …) wrap the same hooks so you don’t hand-roll loading/error state yourself - see Guard components:
What this SDK does not do
There’s noconsume() here on purpose - a quota check enforced only in the browser is trivially bypassed. Commit usage from your backend (@kerne/server’s consume()), and use this SDK only to reflect the result in your UI.
