01
Install the package.
No account. No dashboard. No signup wall.
Auth that lives in your app.
Own Auth is an open-source TypeScript authentication library. Logins, sessions, magic links, phone codes, API keys, and teams. Runs in your app. Stores everything in your own database.
$ npm install own-auth
$ npx own-auth migrate
Two commands. Auth is in your app.Auth shouldn't own you.
Hosted platforms like Clerk are fast until the bill scales with your users, migrating means rewriting half your app, and someone else controls your user data.
Building it yourself is free until it holds your weekend hostage and you miss one detail. And with auth, one missed detail is a breach.
There's a better way.
Install. Connect. Ship.
02
Connect your database.
Add your Postgres URL, run one command.
03
Call it from your code.
Sign people up. Log them in. Done.
Works with Next.js, Express, Fastify, Hono, AdonisJS, Remix, Astro, SolidStart, Nuxt, and SvelteKit, or whatever you're using. Not tied to any framework. Browse all framework guides or compare auth approaches.
Passwords
Classic sign up and sign in. Passwords stored safely, never in plain text.
Magic links
Passwordless login. You email a link, they click it, they're in. Each link works once, then expires.
Phone login (SMS OTP)
Text them a code, they type it in. Built-in protection against spam and abuse.
Sessions
How users stay signed in between visits. Stored in your database, so you can log out any device, instantly.
Organisations
Teams, workspaces, members, roles, and invites. Built in, not something you bolt on later.
API keys
Secure keys that let other apps and scripts talk to yours. Shown once, revoke anytime.
Audit logs
A record of who did what, when, and from where. Written automatically.
Rate limiting
Automatically slows down anyone hammering your login or spamming codes. Zero setup.
Boring security. The good kind.
Every password, session token, and login code is hashed before it's stored. So even if someone got into your database, there's nothing usable to steal.
Every link and code works once, then dies. No homemade crypto. No clever tricks. Just the right defaults.
Don't want to deal with sending emails? We will.
Own Auth works completely on its own. Plug in any email provider you like.
But if you'd rather skip that setup, Own Auth Delivery is there. A managed service that sends your magic links, verification emails, password resets, and invites. Queued and retried, so nothing gets lost.
What it does
Sends the email. That's it.
What it never does
Create users.
Verify logins.
Touch your data.
3,000 emails/month free. No credit card required.
Your app creates the link. Delivery just sends it.One key, one env variable. No web domain? We'll host the link pages for you.
Built for how you actually build.
TypeScript-first, with clear, typed errors. Works with Next.js out of the box. Works with Express, Fastify, Hono, AdonisJS, Remix, Astro, SolidStart, Nuxt, and SvelteKit, or anything else too. It's not locked to one framework. First login working in minutes, not days.
app.ts
import { createOwnAuth } from "own-auth"
const auth = createOwnAuth({
tokenPepper: process.env.OWN_AUTH_TOKEN_PEPPER
})
// Sign someone up
const { user } = await auth.signUpEmailPassword({
email: "dev@example.com",
password: "correct-horse-battery-staple"
})
// Log them in
const result = await auth.signInEmailPassword({
email: "dev@example.com",
password: "correct-horse-battery-staple"
})
if (result.status === "mfa_required") {
const { challengeToken, methods, expiresAt } = result
// Return these fields so the client can complete MFA.
} else {
const { sessionToken } = result
// Move the token through your app's session transport.
}
The core is free. Forever. Auth, sessions, organisations, API keys, audit logs, all open source.
Ship auth today. Own it forever.
Production-ready auth in minutes. Your app, your database, your users.