Type-safe authentication for TypeScript. OAuth 2.1, MCP, passkeys, agents.

by GLINR STUDIOS · a GLINCKER LLC project

Quickstart · Docs · Examples · Discussions · TheAuth Cloud

---

Why TheAuth

Most auth libraries stop at human sign-in. That leaves you stitching together separate systems when your AI agents need identity, scoped permissions, delegation, and audit trails. TheAuth handles both in one place.

How it differs

Ask yourself about the auth library you're using or evaluating:

• Does it model AI agents as first-class identities, with their own scoped permissions and an audit trail you can export, not just human users with API keys?
• Does it ship an MCP OAuth 2.1 authorization server that complies with the published RFC stack (9728, 8707, 8414, 7591), so your agents can talk to MCP servers without you writing the spec?
• Does it run on Cloudflare Workers, Bun, and Deno without Node-only APIs in the core?
• Does it give you delegation chains with depth limits, budget policies per agent, and CIBA-style approval flows for sensitive tool calls?

If any of those is a no, that gap is why theauth exists.

Agent identity

Cryptographic bearer tokens (kv_...), wildcard permission matching, delegation chains with depth limits, budget policies, anomaly detection, and CIBA approval flows.

Human auth

14 methods: email/password, magic link, email OTP, phone SMS, passkey/WebAuthn, TOTP 2FA, anonymous, Google One-tap, Sign In With Ethereum, device authorization, username/password, captcha, password reset, session freshness.

OAuth

17 first-class providers: Apple, Atlassian, Discord, Dropbox, Figma, GitHub, GitLab, Google, LinkedIn, Microsoft, Notion, Reddit, Slack, Spotify, Twitch, Twitter/X, Zoom. Plus a generic OIDC factory for anything else.

MCP OAuth 2.1

Authorization server for the Model Context Protocol. PKCE S256, RFC 9728 / 8707 / 8414 / 7591.

Enterprise

Organizations with RBAC, SAML 2.0 and OIDC SSO, admin controls (ban/impersonate), API key management, SCIM directory sync, multi-tenant isolation, GDPR export/delete/anonymize, compliance reports for EU AI Act, NIST, SOC 2, ISO 42001.

Runs on the edge

Works on Cloudflare Workers, Deno, and Bun without code changes. Three runtime dependencies: drizzle-orm, jose, zod.

Security

Rate limiting per agent and per IP, HIBP password breach checking, CSRF protection, httpOnly secure cookies, email enumeration prevention, trusted device windows, signed expiring reset tokens, session freshness enforcement.

Performance

The policy engine hits 2.6M warm-cache evals/sec with a p99 of 500ns. Cold paths stay under 0.3ms p99 on direct permissions, RBAC role expansion, and ReBAC graph lookups. Numbers from pnpm bench on the policy-engine suite in packages/core/bench/, reproducible locally.

---

Install

npm install @glinr/theauth
# or
pnpm add @glinr/theauth
# or
yarn add @glinr/theauth

import { createTheAuth } from "@glinr/theauth";
import { emailPassword, passkey } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";

const auth = await createTheAuth({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword(), passkey()],
});

const app = new Hono();
app.route("/api/auth", createHonoAdapter(auth));

// Create an AI agent with scoped MCP permissions
const agent = await auth.agent.create({
  ownerId: "user-123",
  name: "github-reader",
  type: "autonomous",
  permissions: [{ resource: "mcp:github:*", actions: ["read"] }],
});

const result = await auth.authorize(agent.id, {
  action: "read",
  resource: "mcp:github:repos",
});
// { allowed: true, auditId: "aud_..." }

---

How TheAuth compares

Capability	Auth0	Clerk	Better-Auth	NextAuth	Lucia	TheAuth
License	Proprietary	Proprietary	MIT	ISC	MIT	MIT
Self-hosted	Partial	No	Yes	Yes	Yes	Yes
OAuth 2.1 server	Yes	Yes	Partial	No	No	Yes
MCP OAuth 2.1	No	No	No	No	No	Yes
Passkeys / WebAuthn	Yes	Yes	Plugin	Plugin	No	Yes
Multi-tenant / orgs	Yes	Yes	Plugin	No	No	Yes
Audit log	Yes (paid)	Yes (paid)	No	No	No	Yes
AI agent identity	No	No	No	No	No	Yes
Edge runtimes	Partial	No	Yes	Partial	Yes	Yes

---

Features

Full feature checklist (click to expand)

Authentication

• Email and password with HIBP breach checking
• Magic link
• Email OTP
• Phone SMS OTP
• Passkeys / WebAuthn
• TOTP 2FA (authenticator apps)
• SAML 2.0 and OIDC SSO
• Anonymous sessions
• Google One Tap
• Sign In With Ethereum
• Device Authorization (TV / CLI flows)
• Username and password
• Captcha integration
• Session freshness enforcement

OAuth 2.1

• Authorization Code + PKCE
• Client Credentials
• Device Authorization Grant
• Refresh Token rotation
• Token introspection
• Dynamic Client Registration (RFC 7591)
• Server metadata (RFC 8414)
• Resource indicators (RFC 8707)
• Authorization Server Issuer Identification (RFC 9728)

MCP Support

• Full OAuth 2.1 authorization server for the Model Context Protocol
• PKCE S256 mandatory
• RFC 9728 / 8707 / 8414 / 7591 compliant
• Agent token issuance and validation

AI Agent Identity

• Cryptographic bearer tokens (kv_...)
• Wildcard permission matching
• Delegation chains with configurable depth limits
• Budget policies per agent
• Anomaly detection
• CIBA-style approval flows for sensitive tool calls
• Full audit trail per agent action

Framework Adapters

• Next.js 15 (App Router, Route Handlers, Middleware)
• SvelteKit
• Nuxt / Vue
• Hono (Cloudflare Workers, Bun, Deno)
• Express
• Fastify
• Astro
• NestJS
• SolidStart
• TanStack Start
• React Native / Expo
• Electron

Database Adapters

Built-in: SQLite, PostgreSQL, MySQL, Cloudflare D1

Plugin: Prisma (share an existing PrismaClient)

Enterprise

• Organizations with RBAC
• SCIM directory sync
• Admin controls (ban, impersonate)
• API key management
• Multi-tenant isolation
• GDPR: export, delete, anonymize
• Compliance reports: EU AI Act, NIST, SOC 2, ISO 42001

Edge Runtimes

• Cloudflare Workers (D1, KV)
• Vercel Edge Functions
• Deno Deploy
• Bun
• Three runtime dependencies: drizzle-orm, jose, zod

---

Quick start by framework

Next.js (App Router)

npm install @glinr/theauth @glinr/theauth-nextjs

// app/api/auth/[...theauth]/route.ts
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createNextAuthHandler } from "@glinr/theauth-nextjs";

const auth = await createTheAuth({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword()],
});

const handler = createNextAuthHandler(auth);
export { handler as GET, handler as POST };

// app/dashboard/page.tsx (Server Component)
import { getServerSession } from "@glinr/theauth-nextjs";

export default async function Dashboard() {
  const session = await getServerSession();
  if (!session) redirect("/sign-in");
  return <h1>Hello, {session.user.email}</h1>;
}

See examples/nextjs-app for a full working example.

SvelteKit

npm install @glinr/theauth @glinr/theauth-sveltekit

// src/hooks.server.ts
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createSvelteKitHandler } from "@glinr/theauth-sveltekit";

const auth = await createTheAuth({
  database: { provider: "sqlite", url: "theauth.db" },
  plugins: [emailPassword()],
});

export const handle = createSvelteKitHandler(auth);

// src/routes/+layout.server.ts
import { getSession } from "@glinr/theauth-sveltekit";

export async function load(event) {
  const session = await getSession(event);
  return { session };
}

Vue / Nuxt

npm install @glinr/theauth @glinr/theauth-nuxt

// server/plugins/theauth.ts
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";

export const auth = await createTheAuth({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword()],
});

// nuxt.config.ts
export default defineNuxtConfig({
  modules: ["@glinr/theauth-nuxt"],
});

Hono (Cloudflare Workers / Express / Bun)

npm install @glinr/theauth @glinr/theauth-hono

import { Hono } from "hono";
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";

type Env = { DATABASE_URL: string };
const app = new Hono<{ Bindings: Env }>();

app.use("/api/auth/*", async (c, next) => {
  const auth = await createTheAuth({
    database: { provider: "postgres", url: c.env.DATABASE_URL },
    plugins: [emailPassword()],
  });
  return createHonoAdapter(auth)(c, next);
});

export default app;

See examples/hono-server and examples/cloudflare-workers.

---

Documentation

Primary docs: docs.theauth.dev

Section	Link	What you will find
Getting Started	docs.theauth.dev/docs/quickstart	Installation, first auth flow
Authentication	docs.theauth.dev/docs/auth	All auth methods and plugins
Agent Identity	docs.theauth.dev/docs/agents	Agent tokens, delegation, policies
Permissions	docs.theauth.dev/docs/permissions	RBAC, wildcard matching, ReBAC
MCP OAuth 2.1	docs.theauth.dev/docs/mcp	MCP auth server setup
Framework Adapters	docs.theauth.dev/docs/adapters	Next.js, Hono, SvelteKit, etc.
API Reference	docs.theauth.dev/docs/api	Config, types, errors
Security	SECURITY.md	Threat model, disclosure policy

---

Framework adapters

Package	Framework	Directory
@glinr/theauth-nextjs	Next.js 15 (App Router)	packages/adapters/nextjs
@glinr/theauth-nextjs-auth	Next.js (external auth backend)	packages/adapters/nextjs-auth
@glinr/theauth-hono	Hono (Workers, Bun, Deno)	packages/adapters/hono
@glinr/theauth-express	Express	packages/adapters/express
@glinr/theauth-fastify	Fastify	packages/adapters/fastify
@glinr/theauth-sveltekit	SvelteKit	packages/adapters/sveltekit
@glinr/theauth-nuxt	Nuxt / Vue 3	packages/adapters/nuxt
@glinr/theauth-astro	Astro	packages/adapters/astro
@glinr/theauth-nestjs	NestJS	packages/adapters/nestjs
@glinr/theauth-solidstart	SolidStart	packages/adapters/solidstart
@glinr/theauth-tanstack	TanStack Start	packages/adapters/tanstack
@glinr/theauth-expo	React Native / Expo	packages/adapters/expo
@glinr/theauth-electron	Electron	packages/adapters/electron

---

Database adapters

SQLite, PostgreSQL, MySQL, and Cloudflare D1 are built into the core package. Use the Prisma adapter to share an existing PrismaClient.

Package	What it connects	Directory
Built-in SQLite	better-sqlite3, bun:sqlite, D1	core
Built-in PostgreSQL	pg, postgres, Neon, Supabase	core
Built-in MySQL	mysql2	core
@glinr/theauth-prisma	Prisma (share your PrismaClient)	packages/prisma

---

Example apps

Example	What it shows	Directory
nextjs-app	Full Next.js 15 App Router integration	examples/nextjs-app
nextjs-demo	UI components + sign-in flows	examples/nextjs-demo
hono-server	Standalone Hono API with auth	examples/hono-server
cloudflare-workers	Workers + D1 database	examples/cloudflare-workers
mcp-server	MCP OAuth 2.1 authorization server	examples/mcp-server
basic-agent	AI agent token issuance and policy	examples/basic-agent
migrate-from-auth0	Step-by-step Auth0 migration	examples/migrate-from-auth0
migrate-from-better-auth-agent-plugin	Migration from better-auth agent plugin	examples/migrate-from-better-auth-agent-plugin

---

TheAuth Cloud

Hosted version with dashboard, billing, and zero infrastructure. app.theauth.dev

Plan	MAU	Price
Free	1,000	$0
Starter	10,000	$29/mo
Growth	50,000	$79/mo
Scale	200,000	$199/mo
Enterprise	Custom	Custom

---

Start free · Pricing · Self-host instead

---

Security

Responsible disclosure: see SECURITY.md. Do not open a public issue for vulnerabilities.

---

Roadmap

Follow development on GitHub Discussions and the changelog.

---

Contributing

See CONTRIBUTING.md. First-time contributor? Look for issues labeled good first issue.

By contributing, you agree to the Code of Conduct.

---

License

MIT (c) GLINCKER LLC

---

Built by the founder of theSVG.org.
A Product of GLINR STUDIOS | A GLINCKER COMPANY