Skip to content
UT Studio
Search products
IntegrationsBeta

Auth Toolkit

Sessions, OAuth and SSO seams with the security decisions already made and written down.

€49 — see licence tiersVersion history
Latest version
0.9.0
Updated
Difficulty
Advanced
Licence
Pro

Overview

Authentication is where most codebases accumulate their quietest bugs. This toolkit ships the parts that are easy to get subtly wrong: session rotation on privilege change, an AuthIdentity model that makes adding SSO a row rather than a migration, and tokens stored hashed so a database read yields nothing usable.

Screenshots

Active sessions list with device and location

Active sessions list with device and location

Features

  • Hashed session tokens

    Only the hash is stored, so a database read cannot yield a usable session.

  • Rotation on privilege change

    A role change rotates the session, closing the window where an old token carries new rights.

  • SSO-ready

    SAML slots into the existing AuthIdentity model without a schema change.

Architecture

Identity separate from credentials

A User has many AuthIdentity records — password, GitHub, Google, SAML — rather than a password column. Users acquire login methods over time and enterprises demand SSO; modelling it this way from the start means the enterprise conversation costs a row.

Tech stack

Built with

What the product is implemented in.

Requires

What you must already have. These block installation.

Works alongside

Verified to work with, but not required.

Folder structure

Folder structure
src/
  session/            issue · verify · rotate · revoke
  identity/           password · oauth · saml adapters
  policy/             what a role may do, as pure functions

Requirements

Node.js
≥ 22.12LTS or current
Package manager
pnpm ≥ 10npm and yarn also work
Operating system
macOS, Linux, Windows (WSL2)

Installation

  1. Unpack the download

    The archive contains the full source. There is no installer and no post-install script.

    bash
    unzip auth-toolkit.zip
cd auth-toolkit

  2. Install dependencies

    bash
    pnpm install

  3. Configure the environment

    Copy the example file and fill in the variables listed under Environment variables.

    bash
    cp .env.example .env

Quick start

  1. Start the development server

    bash
    pnpm dev

  2. Verify the install

    Runs formatting, lint, type-check, tests and a production build.

    bash
    pnpm check

Environment variables

Environment variables
VariableRequiredDescription
DATABASE_URLRequiredPostgreSQL connection string. Use a pooled endpoint in serverless environments.postgresql://user:pass@localhost:5432/app
SESSION_SECRETRequiredAt least 32 characters. Rotating it invalidates every session, which is the intended emergency control.

Configuration

  • Session lifetime

    Absolute and idle expiry are separate values, because they answer different questions.

    src/session/config.ts

Deployment

  • Vercel

    Zero-config. Set the environment variables listed above and connect the repository.

  • Docker

    A multi-stage Dockerfile is included, producing a standalone image with no build toolchain.

  • Any Node host

    Builds to a standard Node server. Nothing depends on a platform-specific runtime.

Compatibility

Framework and runtime versions this product supports
TechnologyVersionsStatus
Node.js≥ 22.12Supported
Edge runtimeanyNot supported

Password hashing requires Node crypto.

What changed in 0.9.0

Beta. The API may change before 1.0.

  • addedSAML adapter behind the existing AuthIdentity interface.
  • securitySessions now rotate on privilege change.

Version history

  1. 0.9.0

    Beta

    Beta. The API may change before 1.0.

    • addedSAML adapter behind the existing AuthIdentity interface.
    • securitySessions now rotate on privilege change.

Dependencies

  • requiresPostgreSQL≥ 14

Roadmap

  1. In progressQ4 2026

    Passkeys

    WebAuthn as another AuthIdentity kind.

Documentation

Support

Frequently asked questions

Related products

Curated by us, not inferred — these are the ones that genuinely pair with it.

Built with the same stack

Products that share a framework with this one.