Duck Auth
WIPFaceted, framework-agnostic, transport-pluggable authentication for modern TypeScript apps. Password, magic-link, OAuth, passkey, API keys, SAML — wired with one root.
Authentication that doesn’t lock you into a framework.
One root, fourteen facets, every transport. Wire it into Express, Hono, Next.js, Fastify, Koa, Elysia, NestJS, gRPC, or any Web-Fetch runtime — one adapter import.
14-facet AuthEngine
One typed root exposes sessions, identities, passwords, providers, MFA, flows, API keys, M2M, orgs, idempotency, hijack policy, and anomaly detection.
Cookie + Bearer + JWT
Pluggable transports: HttpOnly __Host- cookies, opaque bearer tokens, stateless JWT with live JWKS rotation, all bindable to a client public key via DPoP (RFC 9449).
Every sign-in shape
Password, magic-link, six OAuth providers (Google / GitHub / LinkedIn / Microsoft / Discord / Apple), WebAuthn passkeys, API keys, SAML — all on the same provider interface.
Channels included
Console, SMTP, Resend, AWS SES, Twilio SMS, and Web Push channels for magic-link delivery, password-reset, MFA codes, and verification emails.
Production posture
AuthEngine.strict() rejects insecure config at boot — no NoopLimiter, no MemoryAdapter, no insecure cookies. Compliance presets for GDPR / SOC2 / HIPAA / FIPS.
OpenAPI + OTel + OIDC
Emit an OpenAPI 3.1 spec from the CLI. Expose JWKS + .well-known/openid-configuration. OpenTelemetry instrumentation with redacted PII attributes.
Install
Scaffold a starter, or wire AuthEngine by hand.
# Install
bun add @gentleduck/auth
# Scaffold
bunx @gentleduck/auth init src/lib --production
# Wire on Express
import { mountSignIn } from '@gentleduck/auth/server/express'
app.post('/auth/signin', mountSignIn(auth))Free & open source
gentleduck is MIT licensed and will always be free and open source. Every package ships with full source access — fork it, modify it, own it.