Blog

Auth for non-Next.js stacks

Framework-independent authentication starts with the HTTP boundary. See how the same Own Auth handler mounts in SolidStart, Astro, Hono, Express, and Fastify.

Account recovery is an authentication system

Protect password reset and factor recovery with generic responses, single-use tokens, deliberate fallback checks, and post-recovery revocation.

Why SaaS applications need first-class API keys

Machine integrations need credentials with distinct ownership, scopes, rotation, revocation, and auditability instead of copied user sessions.

Organisations, roles, and invites for B2B applications

Treat tenant membership as server-side authorization, keep roles explicit, and make email invitations single-use and auditable.

Database session security beyond cookie flags

Protect opaque session tokens with hashed storage, absolute and idle expiry, rotation, targeted revocation, and server-side verification.

Email verification flows that do not leak account state

Issue single-use verification links, return generic request responses, consume tokens on the backend, and separate delivery status from identity proof.

No-coder's guide to Own Auth (2026)

Own Auth adds sign-up and login to an AI-built app while keeping your users in your own database.

Phone login and SMS security

Protect SMS code login with short expiry, attempt limits, hashed storage, delivery budgets, generic responses, and stronger checks for sensitive actions.

Rate limiting authentication endpoints

Limit sign-in, recovery, magic-link, SMS, invitation, and API-key operations without creating an account-enumeration side channel.

Authentication audit logs that help during an incident

Record security decisions with stable event names, actors, targets, and timestamps while excluding credentials and bearer tokens.

API key security from creation to revocation

Design API keys as high-value bearer credentials with one-time display, protected storage, scopes, expiry, rotation, and safe observability.

Password hashing in 2026

Use Argon2id, keep salts and algorithm parameters with each hash, plan upgrades, and protect the verification path with capacity limits.

The auth ecosystem in July 2026

Better Auth joined Vercel, Arctic was deprecated, and Lucia narrowed to replacement code. Together, the changes clarify what teams should verify in an auth dependency.

Production authentication checklist

Review secrets, sessions, recovery, rate limits, email delivery, tenant authorization, audit events, backups, and incident controls before launch.

The real cost of hosted authentication

Evaluate hosted authentication by billing unit, paid feature gates, migration work, operational ownership, and the engineering work a self-hosted alternative retains.

Own Auth in five minutes

Install Own Auth, apply its Postgres schema, create an email-and-password account, and verify a revocable session from your backend.

What to look for in a Postgres auth library

Evaluate a Postgres auth library by its credential storage, session lifecycle, authorization boundary, migrations, abuse controls, and operational model.

What happens when your auth library gets acquired

An acquisition does not rewrite an open-source auth library overnight. It changes who funds the work, how priorities are set, and which signals teams should track.

Why we built Own Auth

Own Auth runs in the application backend and, by default, stores users, sessions, organisations, and API keys in the application's Postgres database.