How duck-auth compares
WIPWhat duck-auth is, what it deliberately leaves out, and when a hosted service or a smaller library fits better
Auth for a TypeScript backend comes three ways: a hosted service that runs it for you (Clerk, WorkOS, Stytch), a framework's own solution (Auth.js), or a library you run yourself. duck-auth is a library you run yourself, in your process and against your database, with the providers, transports and stores already written.
What it ships
| Area | In the package |
|---|---|
| Sign-in | Passwords, magic links, OAuth (Apple, Discord, GitHub, Google, LinkedIn, Microsoft, or any other through providers/oauth/core), passkeys, API keys, SAML. |
| Second factors | TOTP, backup codes, WebAuthn; step-up to AAL 2 and remembered devices. |
| Sessions | Cookie, bearer and JWT transports (HS256, ES256, RS256, EdDSA, with key rotation and a JWKS), DPoP, hijack and anomaly detection, impersonation. |
| Storage | Drizzle on Postgres, MySQL and SQLite; Redis and Valkey for sessions, limits and events; an in-memory adapter for tests. |
| Servers | Glue for Express, Fastify, Hono, Koa, Elysia, Next.js, NestJS, gRPC and any fetch runtime; you write the routes over auth.flows. |
| Operations | Multi-tenancy, organisations, signed webhooks, encryption at rest, GDPR, HIPAA, SOC 2 and FIPS presets, and a strict() gate that refuses a production engine built with development pieces. |
What it leaves out
- Hosting. There is no service and no dashboard; you run it and own the data.
- Routes and UI. There are no ready-made routes and no browser client: your routes call
auth.flows, and your pages call your routes. - Authorization. It says who the caller is, never what they may do. That is duck-iam; see Bridging to duck-iam.
- SMS codes. There is no SMS second factor; SIM swaps make it a weak one. Your
deliverfunction can still send links by SMS.
Choosing
- Pick a hosted service to run nothing and to get prebuilt sign-in screens, at the price of per-user billing and your users living in someone else's database.
- Pick a smaller library to write the providers and flows yourself.
- Pick duck-auth to own the runtime and the data without writing the providers, flows and stores.