Introduction
nauth-toolkit is a framework-agnostic authentication library for Node.js. It runs inside your application as an embedded library—not a SaaS service, proxy, or microservice. Authentication logic executes in your process, using your database and infrastructure. Add complete authentication to NestJS, Express, Fastify, or any Node.js framework without vendor lock-in.
nauth-toolkit is under active development. API may change frequently.
See nauth-toolkit in action at demo.nauth.dev — a working demo app showcasing signup, login, MFA, social auth, and session management.
Ready to start? Check out Quick Start to configure nauth-toolkit.
Features
Authentication Methods
Signup/login with configurable password policies, reset flows, email and phone verification
Google, Apple, Facebook OAuth with web redirect and native mobile token flows
TOTP authenticator apps, SMS codes, WebAuthn passkeys, backup recovery codes
Risk-based MFA triggered by login context, location changes, new devices
Security & Compliance
Per-IP and per-user limits with configurable account lockout policies
Refresh token rotation, reuse detection, distributed locks, optimistic locking
Cookie-based token delivery with automatic CSRF safeguards
Comprehensive logging for logins, MFA, password changes, security events
Session & Device Management
Device ID, name, type for each session with fingerprinting
Track login locations using MaxMind GeoIP2 for risk analysis
Single, limited concurrent, or unlimited sessions
Remember device to bypass MFA on known hardware
Manual or policy-based automatic invalidation
Bearer tokens with configurable algorithms (HS256, RS256) and expiration
HttpOnly secure cookies with CSRF protection
HttpOnly cookies or header tokens on same backend. Best of both for web and mobile
Developer Experience
Multi-step flows with unified API. Returns challenge states (not errors) for verification, MFA, password changes
Handlebars templates with file-based customization, global variables, custom helpers
Winston, Pino, or NestJS logger compatible. Automatic PII redaction, structured logging
Extensible hooks at signup, login, MFA triggers, sign-in blocks
Infrastructure Adapters
Memory (dev), Database (single-server), Redis with cluster (production)
PostgreSQL and MySQL via TypeORM
Console (dev), Nodemailer SMTP, AWS SES, Gmail
Console (dev), AWS SNS, Twilio (planned)
Framework Support
Backend integrations plug into your Node.js server; client SDKs run in the browser or mobile app and talk to your nauth-toolkit API.
Backend (Node.js)
| Framework | Status | Package |
|---|---|---|
| NestJS | Full adapter | @nauth-toolkit/nestjs |
| Express | Full adapter | @nauth-toolkit/express |
| Fastify | Full adapter | @nauth-toolkit/fastify |
Frontend (Client SDKs)
| SDK | Status | Package |
|---|---|---|
| Client SDK | Framework-agnostic | @nauth-toolkit/client |
| Angular | Full adapter | @nauth-toolkit/client-angular |
The Client SDK (@nauth-toolkit/client) is framework-agnostic and can be used with React, Vue, Svelte, and other TypeScript-based frontends. The Angular package builds on the Client SDK and adds Angular-specific services and wiring.
Why nauth-toolkit?
vs SaaS Authentication Providers
What you gain:
- Complete control over code and data
- No vendor lock-in or usage-based pricing
- Customize flows without limitations
- Data in your database, your infrastructure
- No additional costs
What you trade:
- You manage infrastructure and security audits
- No managed compliance certifications (HIPAA, SOC2)
- Limited to Node.js ecosystem
When to Choose nauth-toolkit
- Need full control over auth logic
- Want predictable infrastructure costs
- Require deep customization
- Building on Node.js (NestJS, Express, Fastify)
GitHub & Community
| Resource | Link |
|---|---|
| Live demo | demo.nauth.dev |
| Source code | github.com/noorixorg/nauth-toolkit |
| Sample applications | github.com/noorixorg/nauth |
| npm packages | npmjs.com/org/nauth-toolkit |
| Discussions & support | github.com/noorixorg/nauth/discussions |
| Bug reports | github.com/noorixorg/nauth/issues |
License: Early Access License — free for commercial and non-commercial use | Version: v0.1.0 | Status: Active Development