An embedded TypeScript library for NestJS, Express & Fastify. Runs in your server, stores data in your database. Free to use.
From simple email/password signup to adaptive multi-factor authentication — all in one library, all fully under your control.
Add complete auth to your existing Node.js app without restructuring your project.
Pick your framework — the same auth engine powers all three.
One TypeScript config drives every auth behavior. Wire up routes by calling service methods from your own controllers.
Use a ready-made SDK or call the REST API directly from any framework.
Security-first architecture with all the infrastructure you need to ship authentication.
Pure TypeScript with zero framework dependencies. The same core powers NestJS, Express, and Fastify.
A unified challenge/response loop handles email verification, MFA, and password changes — one endpoint, all flows.
Argon2id hashing, JWT with RS256/HS256, CSRF protection, refresh token rotation with reuse detection.
Risk-based MFA enforcement triggered by login context — new device, location change, or anomalous patterns.
Comprehensive structured logging for logins, MFA events, password changes, and security incidents.
Per-IP and per-user request limits with configurable account lockout policies and automatic unlocking.
Track login locations with MaxMind GeoIP2. Surface location data in security events and trusted device flows.
In-memory for dev, database-backed for low-traffic, or Redis with cluster support for production scale.
Extensible hooks at signup, login, MFA triggers, and sign-in blocks. Customize any flow without forking.
Define your auth policy in a single TypeScript object. nauth-toolkit reads it at startup and wires up every service, middleware, and flow automatically.
export const authConfig: NAuthConfig = {
signup: {
requireEmailVerification: true,
allowedIdentifiers: ['email', 'username'],
},
mfa: {
enabled: true,
enforcement: 'OPTIONAL',
allowedMethods: [
MFAMethod.TOTP,
MFAMethod.EMAIL,
MFAMethod.SMS,
MFAMethod.PASSKEY,
],
rememberDeviceDays: 30,
},
social: {
google: { clientId: '...', clientSecret: '...' },
apple: { clientId: '...', teamId: '...' },
facebook: { appId: '...', appSecret: '...' },
},
session: {
maxActiveSessions: 5,
revokeOnPasswordChange: true,
},
rateLimit: {
login: { maxAttempts: 5, windowMs: 900_000 },
signup: { maxAttempts: 10, windowMs: 3_600_000 },
},
tokenDelivery: { mode: 'cookie' },
};From this config, nauth-toolkit bootstraps:
authService.signup(dto), get a result. You configure what routes to expose and add custom logic as needed.Authentication is infrastructure — it deserves the same control and visibility as your database or API layer.
If managed compliance or a non-Node.js stack is required, a SaaS auth provider may be a better fit.
Add complete authentication to your Node.js application — social login, adaptive MFA, passkeys, and full audit trails. No third-party services, no per-user fees, no vendor lock-in.