Loading repository data…
glincker / repository
Auth for AI agents and humans. First-class agent identity, MCP OAuth 2.1, delegation, audit. TypeScript, edge-native, MIT.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
Most auth libraries stop at human sign-in. That leaves you stitching together separate systems when your AI agents need identity, scoped permissions, delegation, and audit trails. TheAuth handles both in one place.
Ask yourself about the auth library you're using or evaluating:
If any of those is a no, that gap is why theauth exists.
Cryptographic bearer tokens (kv_...), wildcard permission matching, delegation chains with depth limits, budget policies, anomaly detection, and CIBA approval flows.
14 methods: email/password, magic link, email OTP, phone SMS, passkey/WebAuthn, TOTP 2FA, anonymous, Google One-tap, Sign In With Ethereum, device authorization, username/password, captcha, password reset, session freshness.
17 first-class providers: Apple, Atlassian, Discord, Dropbox, Figma, GitHub, GitLab, Google, LinkedIn, Microsoft, Notion, Reddit, Slack, Spotify, Twitch, Twitter/X, Zoom. Plus a generic OIDC factory for anything else.
Authorization server for the Model Context Protocol. PKCE S256, RFC 9728 / 8707 / 8414 / 7591.
Organizations with RBAC, SAML 2.0 and OIDC SSO, admin controls (ban/impersonate), API key management, SCIM directory sync, multi-tenant isolation, GDPR export/delete/anonymize, compliance reports for EU AI Act, NIST, SOC 2, ISO 42001.
Works on Cloudflare Workers, Deno, and Bun without code changes. Three runtime dependencies: drizzle-orm, jose, zod.
Rate limiting per agent and per IP, HIBP password breach checking, CSRF protection, httpOnly secure cookies, email enumeration prevention, trusted device windows, signed expiring reset tokens, session freshness enforcement.
The policy engine hits 2.6M warm-cache evals/sec with a p99 of 500ns. Cold paths stay under 0.3ms p99 on direct permissions, RBAC role expansion, and ReBAC graph lookups. Numbers from pnpm bench on the policy-engine suite in packages/core/bench/, reproducible locally.
npm install @glinr/theauth
# or
pnpm add @glinr/theauth
# or
yarn add @glinr/theauth
import { createTheAuth } from "@glinr/theauth";
import { emailPassword, passkey } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";
const auth = await createTheAuth({
database: { provider: "postgres", url: process.env.DATABASE_URL },
plugins: [emailPassword(), passkey()],
});
const app = new Hono();
app.route("/api/auth", createHonoAdapter(auth));
// Create an AI agent with scoped MCP permissions
const agent = await auth.agent.create({
ownerId: "user-123",
name: "github-reader",
type: "autonomous",
permissions: [{ resource: "mcp:github:*", actions: ["read"] }],
});
const result = await auth.authorize(agent.id, {
action: "read",
resource: "mcp:github:repos",
});
// { allowed: true, auditId: "aud_..." }
| Capability | Auth0 | Clerk | Better-Auth | NextAuth | Lucia | TheAuth |
|---|---|---|---|---|---|---|
| License | Proprietary | Proprietary | MIT | ISC | MIT | MIT |
| Self-hosted | Partial | No | Yes | Yes | Yes | Yes |
| OAuth 2.1 server | Yes | Yes | Partial | No | No | Yes |
| MCP OAuth 2.1 | No | No | No | No | No | Yes |
| Passkeys / WebAuthn | Yes | Yes | Plugin | Plugin | No | Yes |
| Multi-tenant / orgs | Yes | Yes | Plugin | No | No | Yes |
| Audit log | Yes (paid) | Yes (paid) | No | No | No | Yes |
| AI agent identity | No | No | No | No | No | Yes |
| Edge runtimes | Partial | No | Yes | Partial | Yes | Yes |
kv_...)Built-in: SQLite, PostgreSQL, MySQL, Cloudflare D1
Plugin: Prisma (share an existing PrismaClient)
drizzle-orm, jose, zodnpm install @glinr/theauth @glinr/theauth-nextjs
// app/api/auth/[...theauth]/route.ts
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createNextAuthHandler } from "@glinr/theauth-nextjs";
const auth = await createTheAuth({
database: { provider: "postgres", url: process.env.DATABASE_URL },
plugins: [emailPassword()],
});
const handler = createNextAuthHandler(auth);
export { handler as GET, handler as POST };
// app/dashboard/page.tsx (Server Component)
import { getServerSession } from "@glinr/theauth-nextjs";
export default async function Dashboard() {
const session = await getServerSession();
if (!session) redirect("/sign-in");
return <h1>Hello, {session.user.email}</h1>;
}
See examples/nextjs-app for a full working example.
npm install @glinr/theauth @glinr/theauth-sveltekit
// src/hooks.server.ts
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createSvelteKitHandler } from "@glinr/theauth-sveltekit";
const auth = await createTheAuth({
database: { provider: "sqlite", url: "theauth.db" },
plugins: [emailPassword()],
});
export const handle = createSvelteKitHandler(auth);
// src/routes/+layout.server.ts
import { getSession } from "@glinr/theauth-sveltekit";
export async function load(event) {
const session = await getSession(event);
return { session };
}
npm install @glinr/theauth @glinr/theauth-nuxt
// server/plugins/theauth.ts
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
export const auth = await createTheAuth({
database: { provider: "postgres", url: process.env.DATABASE_URL },
plugins: [emailPassword()],
});
// nuxt.config.ts
export default defineNuxtConfig({
modules: ["@glinr/theauth-nuxt"],
});
npm install @glinr/theauth @glinr/theauth-hono
import { Hono } from "hono";
import { createTheAuth } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";
type Env = { DATABASE_URL: string };
const app = new Hono<{ Bindings: Env }>();
app.use("/api/auth/*", async (c, next) => {
const auth = await createTheAuth({
database: { provider: "postgres", url: c.env.DATABASE_URL },
plugins: [emailPassword()],
});
return createHonoAdapter(auth)(c, next);
});
export default app;
See examples/hono-server and [examples/cloudflare-workers](https://github.com/glincker/theauth/tree/main/examples/cloudfl
Selected from shared topics, language and repository description—not editorial ratings.
kaizen108 /
Auth for AI agents and humans. First-class agent identity, MCP OAuth 2.1, delegation, audit. TypeScript, edge-native, MIT.
62/100 health