Postgres authentication: keep users and sessions in your database

Own Auth runs in your backend and stores users, credentials, sessions, one-time tokens, organisations, API keys, and audit events in Postgres. Sign-up, sign-in, session lookup, and revocation read and update those tables directly.

Install Own Auth

npm install own-auth

Set DATABASE_URL to the Postgres database where Own Auth should create its tables.

DATABASE_URL=postgres://user:password@localhost:5432/myapp

npx own-auth migrate
npx own-auth status

The migration creates Own Auth's prefixed tables without changing application tables.

Authentication records in Postgres

• Normalized users and provider accounts
• Argon2id password hashes, never plaintext passwords
• Hashed session tokens with absolute and idle expiry
• Hashed magic-link, verification, reset, and invitation tokens
• Organisation membership, roles, permissions, and invitations
• Revocable application API keys and security audit events

Create the auth instance

Set the token pepper, then create the auth instance.

OWN_AUTH_TOKEN_PEPPER=replace-with-a-long-random-secret

import { createOwnAuth } from "own-auth";

const tokenPepper = process.env.OWN_AUTH_TOKEN_PEPPER!;

export const auth = createOwnAuth({
  tokenPepper,
});

Verify opaque sessions

Pass the session token from the application's cookie or authorization header to auth.getCurrentSession. Own Auth hashes the token, queries the matching Postgres record, and returns the user and session only while both remain active and unexpired.