zero-authAuthentication without the auth platform

JWTs, refresh rotation, secure cookies, CSRF, and access control for Node.js APIs.

Start building

Browse the API

Small surface area

One createAuth call, familiar Express middleware, and TypeScript-first types.

Secure token lifecycle

Short-lived access tokens, refresh rotation, revocation hooks, and reuse detection.

Secure browser sessions

HTTP-only cookies with signed double-submit CSRF protection for state-changing requests.

Bring your own storage

No hosted auth platform or user database. Connect your own store and deployment.

A focused auth layer for teams that want control

Ship auth your team can understand.

Keep identity in your application, use standard JWTs at the edge, and add stronger refresh-token protection when your product needs it.

For APIsBearer tokensFor mobile apps, CLIs, and separate frontends.For browsersHTTP-only cookiesKeep browser tokens away from JavaScript.For securityRefresh rotationDetect replay and revoke a complete token family.For authorizationRoles and permissionsProtect routes with coarse or fine-grained access checks.

Get productive quickly

const auth = createAuth({
  accessSecret: process.env.JWT_ACCESS_SECRET!,
  refreshSecret: process.env.JWT_REFRESH_SECRET!,
});

app.get("/profile", auth.protect(), (req, res) => {
  res.json({ user: req.user });
});

zero-auth signs and verifies tokens, but your application owns users, passwords, storage, rate limits, and authorization policy. Start with the quick start, then choose a bearer-token or cookie integration.

Documentation map

Build: quick start, configuration, and client examples
Secure: access control, CSRF, and security checklist
Operate: refresh rotation, deployment, and troubleshooting
Reference: errors and the generated API reference
Maintain: testing, versioning, changelog, and release process

Run the complete Express example →Review the security checklist →