No-coder's guide to Own Auth (2026)

Own Auth adds sign-up and login to TypeScript apps. It supports passwords, magic links, phone codes, Google, GitHub, and Apple login, multi-factor authentication, organisations, and API keys. It runs in your app and stores users in your Postgres database.

What is Own Auth?

Authentication is how an app checks who a user is. Own Auth creates accounts, checks login details, handles account recovery, and signs users out.

After a successful login, Own Auth creates a session. The app sends the session token with later requests, and Own Auth checks it against the database. Expired, revoked, or missing sessions do not identify a user.

The same user and session system works with passwords, magic links, text-message codes, and configured social providers. Your app can offer one method or several.

What does Own Auth handle?

Own Auth hashes passwords before storage. It protects session tokens, magic links, password-reset links, phone codes, invitations, and API keys before storing them. One-time links and codes expire and stop working after they are used.

• Rate limits slow repeated password, email, phone, invitation, and API-key attempts.
• Password reset revokes the user's existing sessions.
• Audit events record security actions without storing raw passwords or tokens.
• Organisation roles and permissions cover Own Auth membership operations.
• Your app controls access to its own projects, orders, files, and other product data.

Where does my user data live?

Own Auth stores users and login records in the Postgres database connected to your app. That database can run locally or through a hosted Postgres provider.

Its migration creates separate tables for users, login methods, sessions, one-time tokens, organisations, memberships, invitations, API keys, rate limits, and audit events. It does not change existing application tables.

Application tables can store the Own Auth user or organisation ID beside product data. The auth records can be backed up or moved with the rest of the database.

How is it different from Clerk or Supabase Auth?

Clerk and Supabase Auth are hosted services. Your app calls their service, and they operate the login system. Own Auth is an installed package. Login runs in your backend and the records stay in your database.

• Clerk and Supabase Auth host the auth service; Own Auth runs in your backend.
• Hosted services store auth records in their systems; Own Auth stores them in your Postgres database.
• Hosted services include provider-managed interfaces; Own Auth uses screens built by your app.
• Hosted services set their own plans and usage limits; Own Auth has no per-user library fee.

The hosted-auth cost comparison covers provider fees and the work kept inside the application.

Why use it with an AI app builder?

An AI coding tool can build the screens and connect them to Own Auth's documented server methods or HTTP handler. Password hashing, session checks, one-time tokens, and auth rate limits remain inside Own Auth instead of being generated in each route.

What do I need?

• A TypeScript app with server code.
• Node.js 20 or later.
• A Postgres database.
• A secret value called OWN_AUTH_TOKEN_PEPPER.
• An email or text-message service if your login flow sends messages.

OWN_AUTH_TOKEN_PEPPER protects session tokens, one-time links, phone codes, invitations, and API keys before their hashes are stored. It is read by the server, not the browser.

How do I add it to my app?

1. Create a Postgres database.
2. Install the own-auth package.
3. Add DATABASE_URL and OWN_AUTH_TOKEN_PEPPER to the server settings.
4. Run npx own-auth migrate to create the auth tables.
5. Create one Own Auth instance in a server-only file.
6. Connect the app's sign-up, login, logout, and session-check routes.

The five-minute walkthrough contains the exact commands and code for email, password, and sessions.

Can I view and edit users?

Own Auth does not include an admin dashboard. Its administration methods can list users, update user details, disable accounts, revoke sessions, and read authentication audit events. An app can use those methods to build its own admin page.