Events & Error handling

Events

The SDK emits events so you can show spinners and handle analytics:

client.on('start', (payload) => {
  console.log('Started:', payload.operation)  // 'signUp' | 'signIn' | 'enroll'
  showSpinner()
})

client.on('success', (payload) => {
  console.log('Success:', payload.operation)
  hideSpinner()
})

client.on('error', (payload) => {
  console.error('Error:', payload.error)
  hideSpinner()
  showError(payload.error.message)
})

client.on('cancelled', (payload) => {
  console.log('Cancelled:', payload.operation)  // 'signUp' | 'signIn'
  hideSpinner()
})

// Unsubscribe
const unsubscribe = client.on('start', handler)
unsubscribe()

Events: 'start', 'success', 'error', 'cancelled'.

Error handling

All methods return Result<T, TryMellonError>. Check result.ok and use result.error.code:

import { isTryMellonError } from '@trymellon/js'

const result = await client.signIn({ externalUserId: 'user_123' })

if (!result.ok) {
  const error = result.error
  switch (error.code) {
    case 'USER_CANCELLED':
      console.log('User cancelled')
      break
    case 'NOT_SUPPORTED':
      await client.otp.send({
        userId: 'user_123',
        email: 'user@example.com',
      })
      break
    case 'PASSKEY_NOT_FOUND':
      await client.signUp({ externalUserId: 'user_123' })
      break
    case 'NETWORK_FAILURE':
      // Often caused by unallowed Origin in TryMellon dashboard (CORS rejection)
      console.error('Network error:', error.details)
      break
    case 'TIMEOUT':
      console.error('Operation timed out')
      break
    default:
      console.error(error.code, error.message)
  }
  return
}

// result.value has sessionToken, user, etc.

Error codes

Webhook event types

The full catalog with payload examples lives in Webhook events. Quick reference:

For HMAC verification and replay protection see Signature verification. For invalidating local session caches see Handling revocation.

Troubleshooting CORS & Network Errors

If your users experience silent failures or you see NETWORK_FAILURE in the SDK with a (null) status in your browser’s Network tab for OPTIONS preflight requests, this typically means CORS rejection.

Ensure that the domain from which the SDK is running (e.g., https://your-app.com) has been added to your Application’s Allowed Origins list in the TryMellon dashboard. TryMellon enforces strict dynamic origin validation to protect your users.

Troubleshooting: rotating secrets without downtime

Rotation returns a previous_secret_expires_at timestamp; both the old and new secret are accepted during that window (default 15 min, max 60 min). Pattern for zero-downtime CI/CD:

1. Call POST /v1/applications/:id/rotate-secret with grace_period_seconds: 1800 (or whatever exceeds your worst-case rollout time).
2. Push the new client_secret to your secret store (Vault, GitHub Secrets, AWS SSM).
3. Trigger your deploy. All replicas eventually pick up the new secret.
4. The previous secret keeps working until the grace window closes — old replicas can drain naturally.

Full example (GitHub Actions): API key rotation.

If you see SECRET_ROTATION_FORBIDDEN, the calling user is not the application creator, tenant owner, or account owner — only those roles can rotate.

Cancel with AbortSignal

const controller = new AbortController()
setTimeout(() => controller.abort(), 10000)

const result = await client.signUp({
  externalUserId: 'user_123',
  signal: controller.signal,
})
if (!result.ok && result.error.code === 'ABORT_ERROR') {
  console.log('Cancelled')
}