01
Install the package.
No account. No dashboard. No signup wall.
Auth that lives in your app.
Own Auth is an open-source TypeScript authentication library. Logins, sessions, magic links, phone codes, API keys, and teams. Runs in your app. Stores everything in your own database.
$ npm install own-auth
$ npx own-auth migrate
Two commands. Auth is in your app.Auth shouldn't own you.
Hosted platforms like Clerk are fast until the bill scales with your users, migrating means rewriting half your app, and someone else controls your user data.
Building it yourself is free until it holds your weekend hostage and you miss one detail. And with auth, one missed detail is a breach.
There's a better way.
Install. Connect. Ship.
02
Connect your database.
Add your Postgres URL, run one command.
03
Call it from your code.
Sign people up. Log them in. Done.
Works with Next.js, Express, Fastify, Hono, AdonisJS, Remix, Astro, SolidStart, Nuxt, and SvelteKit, or whatever you're using. Not tied to any framework. Browse all framework guides or compare auth approaches.
Passwords
Classic sign up and sign in. Passwords stored safely, never in plain text.
Magic links
Passwordless login. You email a link, they click it, they're in. Each link works once, then expires.
Phone login (SMS OTP)
Text them a code, they type it in. Built-in protection against spam and abuse.
Sessions
How users stay signed in between visits. Stored in your database, so you can log out any device, instantly.
Organisations
Teams, workspaces, members, roles, and invites. Built in, not something you bolt on later.
API keys
Secure keys that let other apps and scripts talk to yours. Shown once, revoke anytime.
Audit logs
A record of who did what, when, and from where. Written automatically.
Rate limiting
Automatically slows down anyone hammering your login or spamming codes. Zero setup.
Boring security. The good kind.
Every password, session token, and login code is hashed before it's stored. So even if someone got into your database, there's nothing usable to steal.
Every link and code works once, then dies. No homemade crypto. No clever tricks. Just the right defaults.
Don't want to build an auth dashboard? We did.
Own Auth works completely on its own. Cloud adds operational visibility without taking over your authentication database.
Own Auth Cloud gives you users, organisations, analytics, audit logs, advisory security, and optional managed email and SMS.
What Cloud does
Watches auth events, shows operational data, and delivers auth messages.
What Cloud never does
Connect to your database.
Verify passwords or tokens.
Become the auth source of truth.
3,000 emails/month free. No credit card required.
Your app does the auth. Cloud does the operations.One key, one plugin, and your database stays yours.
Built for how you actually build.
TypeScript-first, with clear, typed errors. Works with Next.js out of the box. Works with Express, Fastify, Hono, AdonisJS, Remix, Astro, SolidStart, Nuxt, and SvelteKit, or anything else too. It's not locked to one framework. First login working in minutes, not days.
app.ts
import { createOwnAuth } from "own-auth"
const auth = createOwnAuth({
tokenPepper: process.env.OWN_AUTH_TOKEN_PEPPER
})
// Sign someone up
const { user } = await auth.signUpEmailPassword({
email: "dev@example.com",
password: "correct-horse-battery-staple"
})
// Log them in
const result = await auth.signInEmailPassword({
email: "dev@example.com",
password: "correct-horse-battery-staple"
})
if (result.status === "mfa_required") {
const { challengeToken, methods, expiresAt } = result
// Return these fields so the client can complete MFA.
} else {
const { sessionToken } = result
// Move the token through your app's session transport.
}
The core is free. Forever. Auth, sessions, organisations, API keys, audit logs, all open source.
Ship auth today. Own it forever.
Production-ready auth in minutes. Your app, your database, your users.