@gentleduck/authWIP

Sign-in for TypeScript apps

Passwords, magic links, OAuth, passkeys, API keys, and SAML behind one typed engine. Bring your own framework, database, and mailer.

One engine
Sessions, identities, flows, providers, hijack policy, and anomaly detection live on one typed root. Add passwords, MFA, passkeys, API keys, or orgs when you need them.
Cookies, bearer, or JWT
Use __Host- HttpOnly cookies, opaque bearer tokens, or stateless JWT with key rotation. Bind any of them to a client key with DPoP (RFC 9449).
Every sign-in method
Password, magic link, WebAuthn passkeys, API keys, and SAML. Six OAuth providers: Google, GitHub, LinkedIn, Microsoft, Discord, and Apple. They all share one provider interface.
Your mailer
Magic links, password resets, and verification emails all go through one deliver function. Send them with whatever your app already uses.
Strict in production
strict() refuses to boot with insecure config, like in-memory limiters, stores, or event buses, or insecure cookies. Presets cover GDPR, SOC 2, HIPAA, and FIPS.
Your database
Drizzle tables for Postgres, MySQL, and SQLite sit next to your own. Redis or Valkey handles rate limits, events, and single-use tokens.

Install

Install the package, then mount a sign-in route.

import { mountSignIn } from '@gentleduck/auth/server/express'
app.post('/auth/signin', mountSignIn(auth))

gentleduck is MIT licensed and will always be free and open source. Every package ships with full source access — fork it, modify it, own it.