Why we built Own Auth

Own Auth is a fully open-source TypeScript authentication library that runs in the application backend. Its default Postgres setup stores users, credentials, sessions, one-time tokens, organisations, API keys, rate-limit counters, and audit events in the application's database. Credential verification and session lookup run in the installed package against configured storage. The application keeps control of its routes, interface, session transport, authorization rules, infrastructure, and auth records.

The user record belongs with product data

Applications connect auth identities to subscriptions, projects, environments, support records, and audit trails. With hosted authentication, those product records live in the application database while the identity record lives elsewhere. Account updates, deletion, exports, and support tools then span both systems.

With the default Postgres setup, Own Auth migrations create namespaced tables for users, credentials, sessions, one-time tokens, organisations, memberships, invitations, API keys, rate-limit attempts, and audit events. Existing application tables are not modified. Product tables can store Own Auth user and organisation IDs without maintaining a separate copy of every user.

Sign-up, sign-in, verification, session lookup, and revocation read and write those tables directly. The source records remain in the application database, so there is no Own Auth account export to request.

Security decisions are part of the package

Own Auth does not leave password hashing and token behavior to each route. New passwords use Argon2id. Session tokens are 256-bit random opaque values, and only their hashes are stored. Sessions enforce absolute and idle expiry and can be revoked individually or for an entire user.

Magic links, email-verification links, password-reset tokens, phone codes, invitations, OAuth state, MFA challenges, and passkey challenges expire and are consumed atomically. Recovery codes are independently hashed and consumed once. A concurrent second request cannot reuse the same credential.

Built-in rate limits cover password, email, SMS, OAuth, invitation, and API-key flows. Security-sensitive operations write audit events without including passwords, session tokens, one-time tokens, SMS codes, or API-key values. These behaviors ship together instead of being reimplemented across route handlers and middleware.

One package covers the authentication lifecycle

Email and password, magic links, SMS codes, OAuth, SAML, passkeys, email verification, password reset, and MFA use one user and session model. MFA supports TOTP, recovery codes, and passkeys. A password reset revokes the user's existing sessions, and account-wide session revocation is a single package operation.

Organisations include members, application-defined roles, permissions, invitations, SAML connections, and SCIM provisioning. Application API keys can belong to a user or organisation, carry scopes, and be revoked individually. Their raw values are shown once and stored as hashes.

HTTP integration and product authorization stay in the application

Own Auth does not ship a hosted sign-in page or require a remote user dashboard. Applications can call methods such as auth.signUpEmailPassword, auth.signInEmailPassword, and auth.getCurrentSession from their backend routes, or mount the included HTTP handler. The handler provides documented routes, request validation, browser-origin checks, cookie handling, and typed errors. The application still owns its interface and navigation.

Own Auth verifies sessions and application API keys. It also enforces permissions inside its organisation, membership, invitation, and organisation API-key operations. It does not decide whether a verified user can read an invoice, deploy an environment, or delete a product record. Those permission checks stay with the product code and data they protect.

Authentication runs from the installed package

The own-auth package, migrations, storage logic, and authentication methods are fully open source under the MIT licence. The package does not require an Own Auth account or licence key. Applications can pin an own-auth version and continue running that version on their own infrastructure.

The quickstart installs the package, applies the database schema, and creates the first database-backed session.