Reauthorization

Reconnect an existing Mono account by passing its account ID to reauthorise().

Reauthorization lets a user restore access to a previously linked account when the institution requires fresh authentication, multi-factor authentication, or another security step.

Required input

reauthorise() accepts the existing Mono account ID as a string.

connect.reauthorise("account_xyz")

It does not accept the short-lived auth code returned by initial linking, and it does not accept a separate reauth token.

Older examples may refer to a reauth token. In @mono.co/connect.js 2.2.0, the implemented signature is reauthorise(accountId: string).

Implement the flow

Create the Connect instance, initialize it with reauthorise(accountId), then open it from a user action.

import Connect from "@mono.co/connect.js"

const accountId = "account_xyz"

const connect = new Connect({
  key: "PUBLIC_KEY",
  scope: "auth",
  onSuccess: ({ code }) => {
    // Send the new code to your backend and complete the
    // server-side flow required by Mono's current API.
    return sendReauthorizationResult(code)
  },
  onClose: () => console.log("Reauthorization closed"),
  onEvent: (eventName, data) => console.log(eventName, data)
})

connect.reauthorise(accountId)

document
  .querySelector("#reauthorize-account")
  .addEventListener("click", () => connect.open())

Use reauthorise() in place of setup() for this widget instance. If both methods are called, the last call replaces the mounted widget configuration.

Where the account ID comes from

For a newly linked account:

1. onSuccess returns { code } in the browser.
2. The browser sends the code to your backend.
3. The backend calls the exchange-token endpoint with the Mono secret key.
4. The response contains the account ID your application stores.
5. A later reauthorization passes that stored account ID to reauthorise().

The account ID may also be available through the Mono dashboard or current customer/account APIs. Your backend should return only the identifier needed by the browser flow; it must not expose the Mono secret key.

Handle validation errors

The SDK validates the accountId argument before mounting the widget.

function startReauthorization(accountId) {
  if (typeof accountId !== "string" || accountId.length === 0) {
    throw new Error("A Mono account ID is required")
  }

  connect.reauthorise(accountId)
  connect.open()
}

The current SDK throws these errors:

Condition	SDK error
Missing or empty account ID	Account ID is required for re-authorisation
Non-string account ID	Invalid accountId: must be a string

Observe the result

Use onEvent to diagnose progress and onSuccess to handle completion.

onEvent: (eventName, data) => {
  if (eventName === "SUBMIT_MFA") {
    analytics.track("mono_reauth_mfa_submitted")
  }

  if (eventName === "ERROR") {
    errorTracker.captureMessage("Mono reauthorization error", {
      extra: data
    })
  }
}

Do not log MFA values, credentials, or identity fields.