FAQ

WIP

Short answers to the questions asked before adopting duck-auth, each pointing at the page that covers it

Where does it run?

In your own process, against your own database, on Node 22 or newer or Bun; see requirements. Comparison sets it beside hosted services and other libraries.

What should a production deploy do?

Call auth.strict({ env: 'production' }) at boot. It throws AUTH_MISCONFIGURED listing every setting that is unsafe in production.
Apply the compliance preset your scope needs.
Read Security.

Can I bring users from another system?

auth.identities.bulkCreate imports the people, matching existing ones by email; see Identities. Password hashes come across as they are: a hasher that verifies both formats moves each one to yours at its owner's next sign-in; see Passwords.

Engines built over the same stores share identities, credentials and sessions. To share one sign-in across subdomains, give the cookie transport a domain.

Can I write my own provider or store?

Yes: see providers and adapters.

Does it decide what a user may do?

No. duck-auth answers who the caller is; duck-iam decides what they may do, and Bridging to duck-iam wires the two together.

Does it support machine-to-machine auth?

Yes: API keys, and an OAuth2 client-credentials exchange on top of them. See API keys.

How do I report a security issue?

Email security@gentleduck.org, not a public issue. The policy is in SECURITY.md.