← Back to guides

Self-hosted authentication without building auth from scratch

Own Auth runs as an installed TypeScript library inside the application backend. Password verification, one-time tokens, and session lookup execute in the application process. Its default Postgres setup stores users, credentials, sessions, organisations, API keys, rate-limit counters, and audit events in the application's database. There is no separate Own Auth user service to deploy.

Three ways to run authentication

  • Hosted identity service: the application calls a vendor-operated auth service that stores the identity records.
  • Self-hosted auth server: the application calls a separate auth service deployed by the team.
  • Embedded library: the application backend calls the installed package and persists auth records in storage it controls.

Own Auth uses the embedded-library model. Authentication methods run with the rest of the backend, while its namespaced tables keep auth records separate from existing application tables.

What Own Auth handles

  • Argon2id password hashing and invalid_credentials responses for failed password sign-ins.
  • Expiring, single-use tokens for magic links, email verification, password resets, and invitations.
  • Opaque database sessions with absolute and idle expiry, individual revocation, and account-wide revocation.
  • Atomic token and code consumption, plus built-in rate limits for sign-up, password sign-in, email and SMS requests, OAuth, invitations, and API-key creation.
  • Explicit OAuth linking by default. A matching verified email does not silently attach a provider to an existing account.
  • Audit events for sign-ins, password changes, session revocation, organisation membership and invitations, and API-key operations.

What remains application code

Applications can mount Own Auth's included HTTP handler for its documented routes, request validation, origin checks, cookies, and typed errors. Applications with custom routes call instance methods directly, including auth.signUpEmailPassword, auth.signInEmailPassword, and auth.getCurrentSession.

The application owns the sign-in interface, navigation, and permission checks for product records. Own Auth verifies sessions and application API keys and enforces permissions inside its organisation, membership, invitation, and organisation API-key operations.