Blog

Integrate Own Auth without a framework adapter

Integrate Own Auth directly in TypeScript server code without a framework adapter. Create the auth instance, handle cookies and MFA results, and connect session lifecycle controls.

How to Migrate from JWTs to Database Sessions Without a Flag Day

A practical guide for moving authentication from stateless JWTs to database backed sessions while maintaining backward compatibility, supporting existing users, and avoiding service disruptions.

Designing SMS Verification for Delivery Reliability and Security

SMS one time codes remain a widely deployed authentication factor, but delivery failures and retry logic introduce security and usability risks. This guide covers how to design SMS verification flows that balance reliability with security based on NIST guidance and OWASP recommendations.

Log authentication events safely: authentication logging without tokens

Practical guidance for recording authentication events that preserve forensic value while excluding passwords, tokens, and session secrets. Implement safe references, structured event schemas, and OWASP aligned controls.

Secure OAuth Redirect URI Handling

Learn how to implement exact redirect URI matching, prevent authorization code interception, and defend against mix up attacks following OAuth security best practices.

How to Size Argon2id Workers for Predictable Sign In Latency

Argon2id password hashing requires careful worker sizing to balance security with consistent authentication latency. This guide explains how to configure memory, iterations, and parallelism parameters alongside worker pool sizing to achieve predictable sign in times.

Secure Password Reset Flow: Preventing Account State Exposure

Learn how to build a password reset flow that protects user accounts from enumeration attacks while maintaining security best practices for token handling and session management.

Consume one time authentication tokens atomically

How to verify and invalidate a single use magic link token atomically in Postgres. Use conditional UPDATE with RETURNING or SELECT FOR UPDATE patterns and follow OWASP token guidance.

Index Postgres sessions for lookup and revocation

How to choose Postgres indexes for fast session lookup, listing, and revocation. Includes recommended CREATE INDEX statements and Own Auth integration notes.

Using PgBouncer Safely with Authentication Sessions

PgBouncer connection pooling behaves differently across session, transaction, and statement modes. For authentication queries that store tokens, sessions, and verification data in Postgres, understanding these differences is essential for security. This guide explains how to configure PgBouncer safely for authentication workloads.

Use Own Auth from SvelteKit server routes

A practical guide to integrating Own Auth in SvelteKit server routes for sveltekit postgres authentication, covering server only initialization, cookie handling, signin flow, and secure session cookies.

Use Own Auth with the Next.js App Router

Build secure, database backed authentication in Next.js using the App Router and Own Auth. Keep your user data in Postgres while leveraging server components, cookies, and route handlers for a complete auth flow.

Choosing a Postgres Schema for Authentication Tables

A practical guide to organizing authentication tables in PostgreSQL using schemas, managing privileges, and implementing row level security for Own Auth implementations.

Database-backed sessions vs. JWTs: when each one wins

Compare database-backed sessions and self-contained JWTs by revocation, claim freshness, trust boundaries, latency, and failure behavior.

Auth for non-Next.js stacks

Framework-independent authentication starts with the HTTP boundary. See how the same Own Auth handler mounts in SolidStart, Astro, Hono, Express, and Fastify.

Account recovery is an authentication system

Protect password reset and factor recovery with generic responses, single-use tokens, deliberate fallback checks, and post-recovery revocation.

How to give one user multiple roles

Keep one identity per person while granting global and organisation-scoped access through explicit roles and permissions.

Why SaaS applications need first-class API keys

Machine integrations need credentials with distinct ownership, scopes, rotation, revocation, and auditability instead of copied user sessions.

What Own Auth writes to Postgres when a user signs up

Follow one email and password sign-up through Own Auth's user, provider account, session, rate-limit, and audit records.

Organisations, roles, and invites for B2B applications

Treat tenant membership as server-side authorization, keep roles explicit, and make email invitations single-use and auditable.

Database session security beyond cookie flags

Protect opaque session tokens with hashed storage, absolute and idle expiry, rotation, targeted revocation, and server-side verification.

Email verification flows that do not leak account state

Issue single-use verification links, return generic request responses, consume tokens on the backend, and separate delivery status from identity proof.

Clerk vs Auth0 in 2026: pricing, features, and tradeoffs

Compare Clerk and Auth0 on pricing, organisations, login UI, sessions, extensibility, and migration to choose the right hosted authentication platform.

No-coder's guide to Own Auth (2026)

Own Auth adds sign-up and login to an AI-built app while keeping your users in your own database.

Phone login and SMS security

Protect SMS code login with short expiry, attempt limits, hashed storage, delivery budgets, generic responses, and stronger checks for sensitive actions.

Rate limiting authentication endpoints

Limit sign-in, recovery, magic-link, SMS, invitation, and API-key operations without creating an account-enumeration side channel.

Authentication audit logs that help during an incident

Record security decisions with stable event names, actors, targets, and timestamps while excluding credentials and bearer tokens.

API key security from creation to revocation

Design API keys as high-value bearer credentials with one-time display, protected storage, scopes, expiry, rotation, and safe observability.

Password hashing in 2026

Use Argon2id, keep salts and algorithm parameters with each hash, plan upgrades, and protect the verification path with capacity limits.

The auth ecosystem in July 2026

Better Auth joined Vercel, Arctic was deprecated, and Lucia narrowed to replacement code. Together, the changes clarify what teams should verify in an auth dependency.

Production authentication checklist

Review secrets, sessions, recovery, rate limits, email delivery, tenant authorization, audit events, backups, and incident controls before launch.

The real cost of hosted authentication

Evaluate hosted authentication by billing unit, paid feature gates, migration work, operational ownership, and the engineering work a self-hosted alternative retains.

Own Auth in five minutes

Install Own Auth, apply its Postgres schema, create an email-and-password account, and verify a revocable session from your backend.

What to look for in a Postgres auth library

Evaluate a Postgres auth library by its credential storage, session lifecycle, authorization boundary, migrations, abuse controls, and operational model.

What happens when your auth library gets acquired

An acquisition does not rewrite an open-source auth library overnight. It changes who funds the work, how priorities are set, and which signals teams should track.

Why we built Own Auth

Own Auth runs in the application backend and, by default, stores users, sessions, organisations, and API keys in the application's Postgres database.