Blog

Configure enterprise SSO and SCIM with Own Auth

Connect organisation SAML sign in with SCIM provisioning, hashed connection tokens, deliberate account linking, and safe deprovisioning.

Postgres schema ownership and application users

CREATE SCHEMA AUTHORIZATION assigns a database owner. It does not create an application account, validate a browser session, or isolate a tenant's rows.

Use Own Auth as an OAuth authorization server

Issue scoped OAuth 2.1 and OpenID Connect tokens to other applications with PKCE, consent, refresh rotation, resource audiences, and introspection.

Protect SolidStart server actions with current sessions

Running a function on the server protects where it executes. Each private query and mutation still needs the current user's identity and permission.

Add TOTP MFA and recovery codes with Own Auth

Encrypt TOTP secrets, confirm enrollment before activation, complete MFA before creating a session, and give users single use recovery codes.

Connect database sessions to Postgres row security

Verify the user in the backend, carry the identity into one database transaction, and keep pooled connections from sharing authorization state.

Add passkeys to an Own Auth application

Configure WebAuthn relying party values, register passkeys from an active session, support usernameless sign in, and manage revocation safely.

Hono authentication starts with the deployment runtime

Hono keeps the HTTP interface portable. Your database driver, secret loading, connection lifetime, and authentication package still need to fit the server that runs them.

Link and unlink OAuth providers with Own Auth

Link OAuth identities from an active session, reject ambiguous email matches, and prevent users from removing their final usable sign in method.

Separate Postgres credential rotation from user sign out

A database password lets the backend connect. An Own Auth session identifies an application user. Rotate and revoke each credential at its actual owner.

Test Own Auth with Vitest and Playwright

Run Own Auth integration tests against a dedicated Postgres database, create isolated users, preserve real session cookies, and cover MFA without adding a production bypass.

Use Own Auth sessions in React Native

Authenticate through your application backend, keep the opaque Own Auth session token in protected device storage, and verify every API request on the server.

Use Own Auth with a Next.js frontend and Express backend

Run Own Auth on Express, call it from Next.js with credentialed requests, preserve response cookies, and keep application authorization on the backend.

Use Own Auth in a NestJS application

Mount the framework neutral Own Auth handler before NestJS body parsing, preserve every response cookie, and authorize application routes from verified sessions.

Keep OAuth account identity stable during schema changes

Migrate OAuth provider identities without silently disconnecting users by preserving issuer semantics, validating uniqueness, staging constraints, and testing real login journeys.

How to structure Own Auth in a TypeScript monorepo

Keep one server package responsible for Own Auth configuration, migrations, secrets, and session verification while applications share only browser clients and public types.

Why a sign out endpoint should be idempotent

A sign out endpoint returns the same success for a live, revoked, or unknown session so retries are safe and the response never confirms which tokens are valid.

Integrate Own Auth without a framework adapter

Integrate Own Auth directly in TypeScript server code without a framework adapter. Create the auth instance, handle cookies and MFA results, and connect session lifecycle controls.

How to Migrate from JWTs to Database Sessions Without a Flag Day

A practical guide for moving authentication from stateless JWTs to database backed sessions while maintaining backward compatibility, supporting existing users, and avoiding service disruptions.

Designing SMS Verification for Delivery Reliability and Security

SMS one time codes remain a widely deployed authentication factor, but delivery failures and retry logic introduce security and usability risks. This guide covers how to design SMS verification flows that balance reliability with security based on NIST guidance and OWASP recommendations.

Log authentication events safely: authentication logging without tokens

Practical guidance for recording authentication events that preserve forensic value while excluding passwords, tokens, and session secrets. Implement safe references, structured event schemas, and OWASP aligned controls.

Secure OAuth Redirect URI Handling

Learn how to implement exact redirect URI matching, prevent authorization code interception, and defend against mix up attacks following OAuth security best practices.

How to Size Argon2id Workers for Predictable Sign In Latency

Argon2id password hashing requires careful worker sizing to balance security with consistent authentication latency. This guide explains how to configure memory, iterations, and parallelism parameters alongside worker pool sizing to achieve predictable sign in times.

Secure Password Reset Flow: Preventing Account State Exposure

Learn how to build a password reset flow that protects user accounts from enumeration attacks while maintaining security best practices for token handling and session management.

Consume one time authentication tokens atomically

How to verify and invalidate a single use magic link token atomically in Postgres. Use conditional UPDATE with RETURNING or SELECT FOR UPDATE patterns and follow OWASP token guidance.

Index Postgres sessions for lookup and revocation

How to choose Postgres indexes for fast session lookup, listing, and revocation. Includes recommended CREATE INDEX statements and Own Auth integration notes.

Using PgBouncer Safely with Authentication Sessions

PgBouncer connection pooling behaves differently across session, transaction, and statement modes. For authentication queries that store tokens, sessions, and verification data in Postgres, understanding these differences is essential for security. This guide explains how to configure PgBouncer safely for authentication workloads.

Use Own Auth from SvelteKit server routes

A practical guide to integrating Own Auth in SvelteKit server routes for sveltekit postgres authentication, covering server only initialization, cookie handling, signin flow, and secure session cookies.

Use Own Auth with the Next.js App Router

Build secure, database backed authentication in Next.js using the App Router and Own Auth. Keep your user data in Postgres while leveraging server components, cookies, and route handlers for a complete auth flow.

Choosing a Postgres Schema for Authentication Tables

A practical guide to organizing authentication tables in PostgreSQL using schemas, managing privileges, and implementing row level security for Own Auth implementations.

Database-backed sessions vs. JWTs: when each one wins

Compare database-backed sessions and self-contained JWTs by revocation, claim freshness, trust boundaries, latency, and failure behavior.

Auth for non-Next.js stacks

Framework-independent authentication starts with the HTTP boundary. See how the same Own Auth handler mounts in SolidStart, Astro, Hono, Express, and Fastify.

Account recovery is an authentication system

Protect password reset and factor recovery with generic responses, single-use tokens, deliberate fallback checks, and post-recovery revocation.

How to give one user multiple roles

Keep one identity per person while granting global and organisation-scoped access through explicit roles and permissions.

Why SaaS applications need first-class API keys

Machine integrations need credentials with distinct ownership, scopes, rotation, revocation, and auditability instead of copied user sessions.

What Own Auth writes to Postgres when a user signs up

Follow one email and password sign-up through Own Auth's user, provider account, session, rate-limit, and audit records.

Organisations, roles, and invites for B2B applications

Treat tenant membership as server-side authorization, keep roles explicit, and make email invitations single-use and auditable.

Database session security beyond cookie flags

Protect opaque session tokens with hashed storage, absolute and idle expiry, rotation, targeted revocation, and server-side verification.

Email verification flows that do not leak account state

Issue single-use verification links, return generic request responses, consume tokens on the backend, and separate delivery status from identity proof.

Clerk vs Auth0 in 2026: pricing, features, and tradeoffs

Compare Clerk and Auth0 on pricing, organisations, login UI, sessions, extensibility, and migration to choose the right hosted authentication platform.

No-coder's guide to Own Auth (2026)

Own Auth adds sign-up and login to an AI-built app while keeping your users in your own database.

Phone login and SMS security

Protect SMS code login with short expiry, attempt limits, hashed storage, delivery budgets, generic responses, and stronger checks for sensitive actions.

Rate limiting authentication endpoints

Limit sign-in, recovery, magic-link, SMS, invitation, and API-key operations without creating an account-enumeration side channel.

Authentication audit logs that help during an incident

Record security decisions with stable event names, actors, targets, and timestamps while excluding credentials and bearer tokens.

API key security from creation to revocation

Design API keys as high-value bearer credentials with one-time display, protected storage, scopes, expiry, rotation, and safe observability.

Password hashing in 2026

Use Argon2id, keep salts and algorithm parameters with each hash, plan upgrades, and protect the verification path with capacity limits.

The auth ecosystem in July 2026

Better Auth joined Vercel, Arctic was deprecated, and Lucia narrowed to replacement code. Together, the changes clarify what teams should verify in an auth dependency.

Production authentication checklist

Review secrets, sessions, recovery, rate limits, email delivery, tenant authorization, audit events, backups, and incident controls before launch.

The real cost of hosted authentication

Evaluate hosted authentication by billing unit, paid feature gates, migration work, operational ownership, and the engineering work a self-hosted alternative retains.

Own Auth in five minutes

Install Own Auth, apply its Postgres schema, create an email-and-password account, and verify a revocable session from your backend.

What to look for in a Postgres auth library

Evaluate a Postgres auth library by its credential storage, session lifecycle, authorization boundary, migrations, abuse controls, and operational model.

What happens when your auth library gets acquired

An acquisition does not rewrite an open-source auth library overnight. It changes who funds the work, how priorities are set, and which signals teams should track.

Why we built Own Auth

Own Auth runs in the application backend and, by default, stores users, sessions, organisations, and API keys in the application's Postgres database.