Verifies pre-extracted credentials against one or more allowed auth modes.
Tries each mode in order — first match wins. A mode is only tried when its credential is present; a JWT that is present but fails verification short-circuits the chain with InvalidJwtError instead of falling through to the next mode. Use verifyAuth to extract and verify in a single call.
When every mode falls through, the returned error names the actual cause rather than a generic failure — MissingCredentialsError when the request carried nothing, InvalidApiKeyError when an apikey matched no configured key, or a 500 (JwksNotConfiguredError, NoKeysConfiguredError) when the server is configured such that no request could ever have succeeded. Every error carries hint, docs, and non-sensitive details.
A misconfiguration 500 is only reported once nothing has matched, so an allowed mode that does match the request's credentials still wins — e.g. ['user', 'secret'] with no JWKS but a valid apikey authenticates as secret. sb_* values in the Authorization slot are API keys, not user tokens, and stay a caller error.
The credentials to verify (from extractCredentials).
Allowed auth modes and optional env overrides.
const credentials = extractCredentials(request)
const { data: auth, error } = await verifyCredentials(credentials, {
auth: ['user', 'publishable'],
})
if (error) {
console.error(error.code, error.message, error.hint)
return Response.json(error.toJSON(), { status: error.status })
}