NEWPublication of @aurabase/js v0.5.1 NPM Packages, Rust Crate v0.1.1 & EcosystemSee the changelog →

Auth

Authentication that your database already understands.

Passwords, social sign-in, magic links, multi-factor and sessions in one SDK. Users live in your project’s PostgreSQL and drive row-level security through auth.uid().

Start for freeRead the docs
15
OAuth providers
6
sign-in methods
TOTP
multi-factor
auth.tsTS
import { createClient } from '@aurabase/aurabase-js'
const aura = createClient(
  'https://my-project.aurabase.cloud',
  'aura_anon_xxx',
)
await aura.auth.signUp({
  email: 'user@example.com',
  password: 'a-long-passphrase',
})
const { data, error } =
  await aura.auth.signInWithPassword({
    email: 'user@example.com',
    password: 'a-long-passphrase',
  })

What’s included

Everything users need to get in. Nothing you have to bolt on.

Passwords

Email and password

Passwords are hashed with Argon2, checked against configurable rules and, optionally, against known data breaches.

Social sign-in

15 OAuth providers

Authorization-code flow with PKCE, native ID-token exchange for mobile apps, and custom OIDC providers.

Passwordless

Magic links and one-time codes

Sign in with a link or a code sent by email, or a code sent by SMS.

Second factor

TOTP multi-factor

Authenticator-app enrollment with recovery codes. Users who have MFA enabled are challenged after OAuth sign-in too.

Sessions

Sessions you can see and revoke

List and revoke sessions, get alerted to new devices, and bind sessions to an IP address or expire them after inactivity.

Abuse protection

Captcha and rate limits

hCaptcha, Cloudflare Turnstile or reCAPTCHA on sign-up, rate limits, and email-domain allow and block lists.

Extensibility

Hooks and webhooks

React to auth events in your own code.

Administration

Admin API and audit log

Manage users, ban and unban, read the audit log and edit email templates from the service role.

Guests

Anonymous users and identity linking

Let visitors in before they sign up, promote them to full accounts later, and link several identities to one user.

Social sign-in

Fifteen providers. One line each.

  • Google
  • GitHub
  • Discord
  • Facebook
  • X (Twitter)
  • Microsoft
  • Apple
  • Spotify
  • Twitch
  • Bitbucket
  • Zoom
  • Notion
  • Figma
  • Kakao
  • Snapchat

Need another identity provider? Register a custom OIDC provider.

How it works

From sign-in to a secured row.

  1. 1

    Sign in

    The user signs in with a password, a provider, a link or a code.

  2. 2

    Verify

    If MFA is enabled, a second factor completes the sign-in.

  3. 3

    Tokens

    The SDK stores the session, refreshes it automatically and rotates refresh tokens.

  4. 4

    Enforce

    Verify claims locally with getClaims, and let RLS policies use auth.uid().

REST API

Prefer plain HTTP? It’s all here.

The SDK is a thin layer over these routes. Send your project’s API key with each request.

MethodEndpointDescription
POST/v1/auth/registerCreate an account with email and password.
POST/v1/auth/loginSign in and receive an access and refresh token.
POST/v1/auth/refreshRotate the refresh token and get a new access token.
POST/v1/auth/logoutEnd the current session.
POST/v1/auth/magic-linkEmail a one-time sign-in link.
POST/v1/auth/email-otp/sendEmail a one-time code.
POST/v1/auth/sms/sendText a one-time code.
GET/v1/auth/oauth/{provider}/startStart an OAuth sign-in with a provider.
GET/v1/auth/userRead the signed-in user.
GET/v1/auth/sessionsList the user’s active sessions.
DELETE/v1/auth/sessions/{id}Revoke one session.
POST/v1/auth/mfa/setupStart TOTP enrollment.
POST/v1/auth/mfa/verify-loginComplete a sign-in that requires a second factor.
POST/v1/auth/anonymousCreate an anonymous user.

Questions

Good to know.

How are passwords stored?+
Passwords are hashed with Argon2. Aurabase never stores them in clear text.
Can I sign users in from a mobile app?+
Yes. Exchange the ID token your app gets from the provider with signInWithIdToken, with no browser redirect.
Where is user data stored?+
In your project’s own PostgreSQL database, in a dedicated auth schema, hosted in the EU (Germany and Finland).
Can I customize the emails users receive?+
Yes. Edit the email templates from the admin API and send through your own SMTP settings.
Is multi-factor authentication supported?+
Yes. Users enroll an authenticator app (TOTP) and receive recovery codes. The SDK raises an MFA challenge whenever a sign-in needs a second factor.
Can visitors use my app before signing up?+
Yes. Create an anonymous user, then promote it to a full account when they sign up. Their data stays attached.

Ready to add sign-in?

Give your users a way in today.

Auth is included in every project. No credit card required.