🔐 Rork Authentication Guide

How to properly authenticate Rork mobile app with mobileAPI

Common Authentication Errors
❌ Missing userId for authenticated action: getMyRefunds
❌ Error: Merchant access required
❌ Request failed: Merchant access required

Root Cause: Rork is making API calls without sending authentication credentials (cookies/tokens)

Solution: Include Credentials in Fetch Requests
Required Fix
fetch('YOUR_API_URL/mobileAPI', {
  method: 'POST',
  headers: {
    'Content-Type': 'application/json',
  },
  credentials: 'include', // ← This is CRITICAL
  body: JSON.stringify({
    action: 'getMyRefunds'
  })
});

Key Point: The credentials: 'include' option ensures authentication cookies are sent with the request, allowing base44Client.auth.me() to work.

Authentication Flow
1

User Logs In

Via mobileAuth function (OTP verification)

2

Session Cookie Created

Base44 SDK creates an authentication cookie (HttpOnly, Secure)

3

Rork Makes API Calls

With credentials: 'include', cookies are automatically sent

4

mobileAPI Authenticates

base44Client.auth.me() reads the cookie and identifies the user

Example: Authenticated API Call in Rork
Complete Example
// In your Rork mobile app component
async function getMyRefunds() {
  try {
    const response = await fetch('https://your-app.base44.com/functions/mobileAPI', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
      },
      credentials: 'include', // ✅ Send auth cookies
      body: JSON.stringify({
        action: 'getMyRefunds'
      })
    });

    const data = await response.json();
    
    if (data.success) {
      console.log('Refunds:', data.data);
    } else {
      console.error('Error:', data.error);
    }
  } catch (error) {
    console.error('Request failed:', error);
  }
}
Merchant-Specific Actions

For merchant actions like merchantOrders,merchantGetStores, the same principle applies:

Merchant Example
fetch('https://your-app.base44.com/functions/mobileAPI', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json' },
  credentials: 'include', // ✅ Required
  body: JSON.stringify({
    action: 'merchantOrders',
    params: {
      store_id: 'store-123', // Optional: filter by location
      status_filter: ['created', 'accepted']
    }
  })
});
Troubleshooting Checklist

User is logged in

Call mobileAuth with phone + OTP first

credentials: 'include' is set

On ALL authenticated API calls

Same-origin or CORS configured

Cookies only work with proper CORS setup

User has correct role

Merchant actions require role: 'merchant'