Skip to main content

v0.3.1

nauth-toolkit team

Added​

  • API key authentication --- long-lived keys that authenticate as their owning user, so scripts and services can reach your protected routes without a browser login. Includes per-key IP restrictions, mandatory expiry, opt-in route protection (@AllowApiKey() / @DenyApiKey()), and frontend SDK support. Off by default.

Enable it in your config:

const authConfig = {
  apiKeys: {
    enabled: true,
    allowUserCreation: false, // false = admin-only creation
    ipRestrictions: { enabled: true },
  },
};

When an API-key header is present it is the only credential used (cookies/bearer are ignored), and keys are stored hashed. See the API Keys guide for setup, route protection, IP restrictions, and admin management.