Own Auth vs. Lucia
Lucia's npm package was deprecated in March 2025, and Arctic was deprecated in July 2026. Lucia now publishes session replacement code, while Arctic publishes OAuth replacement examples. Own Auth includes sessions and OAuth alongside password, magic-link, phone, organisation, API-key, and audit workflows.
Last reviewed against first-party sources on .
Own Auth as a Lucia alternative
You want one installed package for sessions, Google, GitHub, and Apple OAuth, passwords, magic links, phone auth, organisations, API keys, rate limits, and audit events.
| Feature | Own Auth | Lucia |
|---|---|---|
| Data ownership | Your database | Your database |
| Open source | Fully open source | Open source |
| Framework lock-in | None | None |
| Self-hostable | Runs in your backend | Replacement code runs in your backend |
| Passwords | Built in | You implement |
| Magic links | Built in | You implement |
| Phone / SMS login | Built in | You implement |
| Sessions | Database-backed | Single-file replacement code |
| Organisations | Built in | You implement |
| API keys | Built in | You implement |
| Audit logs | Built in | You implement |
| Rate limiting | Built in | You implement |
| Pricing | Free and open source | Free source code and documentation |
Feature
Data ownership
Own Auth
Your databaseLucia
Your databaseFeature
Open source
Own Auth
Fully open sourceLucia
Open sourceFeature
Framework lock-in
Own Auth
NoneLucia
NoneFeature
Self-hostable
Own Auth
Runs in your backendLucia
Replacement code runs in your backendFeature
Passwords
Own Auth
Built inLucia
You implementFeature
Magic links
Own Auth
Built inLucia
You implementFeature
Phone / SMS login
Own Auth
Built inLucia
You implementFeature
Sessions
Own Auth
Database-backedLucia
Single-file replacement codeFeature
Organisations
Own Auth
Built inLucia
You implementFeature
API keys
Own Auth
Built inLucia
You implementFeature
Audit logs
Own Auth
Built inLucia
You implementFeature
Rate limiting
Own Auth
Built inLucia
You implementFeature
Pricing
Own Auth
Free and open sourceLucia
Free source code and documentationProject status
Lucia no longer publishes a maintained npm package. The project now retains the code and documentation needed to replace Lucia v3, including a single-file session implementation, and its example repositories are archived. Arctic's npm package is also deprecated and its site now provides replacement OAuth examples.
Session code in the application
The current Lucia replacement puts session creation, validation, expiry, and revocation into application code. Own Auth uses the same application-owned deployment boundary through an installed package, then adds password, magic-link, phone, organisation, API-key, rate-limit, and audit workflows around its sessions.
OAuth after Arctic
Arctic now documents provider-independent OAuth replacement code instead of a maintained package. Own Auth 0.3.6 includes redirect OAuth for Google, GitHub, and Apple, including authorization, callback completion, explicit account linking, and unlinking in the core package.
The support boundary is changing
Pilcrow says the Lucia project Discord will close by the end of 2026. The Lucia and Arctic sites remain available, and both direct broader authentication questions to the separate Auth Book community. The change is the end of a Lucia-specific support channel, not the disappearance of every resource maintained by the author.
Sources
Product features and prices change. Confirm the current details on these first-party pages before making a purchasing decision.
Lucia fits
You want to copy the session and OAuth replacement examples and maintain that code inside the application.
Own Auth fits
You want one installed package for sessions, Google, GitHub, and Apple OAuth, passwords, magic links, phone auth, organisations, API keys, rate limits, and audit events.
Ready to own your auth?
Two commands. Auth is in your app.