kavachOS

---

Install

npm install @glinr/theauth
# or
pnpm add @glinr/theauth
# or
yarn add @glinr/theauth

import { createKavach } from "@glinr/theauth";
import { emailPassword, passkey } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";

const kavach = createKavach({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword(), passkey()],
});

const app = new Hono();
app.route("/api/auth", createHonoAdapter(kavach));

// Create an AI agent with scoped MCP permissions
const agent = await kavach.agent.create({
  ownerId: "user-123",
  name: "github-reader",
  type: "autonomous",
  permissions: [{ resource: "mcp:github:*", actions: ["read"] }],
});

const result = await kavach.authorize(agent.id, {
  action: "read",
  resource: "mcp:github:repos",
});
// { allowed: true, auditId: "aud_..." }

---

Why theauth

Most auth libraries stop at human sign-in. That leaves you stitching together separate systems when your AI agents need identity, scoped permissions, delegation, and audit trails. theauth handles both in one place.

Capability	Auth0	Clerk	Better-Auth	NextAuth	Lucia	theauth
License	Proprietary	Proprietary	MIT	ISC	MIT	MIT
Self-hosted	Partial	No	Yes	Yes	Yes	Yes
OAuth 2.1 server	Yes	Yes	Partial	No	No	Yes
MCP OAuth 2.1	No	No	No	No	No	Yes
Passkeys / WebAuthn	Yes	Yes	Plugin	Plugin	No	Yes
Multi-tenant / orgs	Yes	Yes	Plugin	No	No	Yes
Audit log	Yes (paid)	Yes (paid)	No	No	No	Yes
AI agent identity	No	No	No	No	No	Yes
Edge runtimes	Partial	No	Yes	Partial	Yes	Yes

---

Features

Authentication

• Email and password with HIBP breach checking
• Magic link
• Email OTP
• Phone SMS OTP
• Passkeys / WebAuthn
• TOTP 2FA (authenticator apps)
• SAML 2.0 and OIDC SSO
• Anonymous sessions
• Google One Tap
• Sign In With Ethereum
• Device Authorization (TV / CLI flows)
• Username and password
• Captcha integration
• Session freshness enforcement

OAuth 2.1

• Authorization Code + PKCE
• Client Credentials
• Device Authorization Grant
• Refresh Token rotation
• Token introspection
• Dynamic Client Registration (RFC 7591)
• Server metadata (RFC 8414)
• Resource indicators (RFC 8707)
• Authorization Server Issuer Identification (RFC 9728)

MCP Support

• Full OAuth 2.1 authorization server for the Model Context Protocol
• PKCE S256 mandatory
• RFC 9728 / 8707 / 8414 / 7591 compliant
• Agent token issuance and validation

AI Agent Identity

• Cryptographic bearer tokens (kv_...)
• Wildcard permission matching
• Delegation chains with configurable depth limits
• Budget policies per agent
• Anomaly detection
• CIBA-style approval flows for sensitive tool calls
• Full audit trail per agent action

Framework Adapters

• Next.js 15 (App Router, Route Handlers, Middleware)
• SvelteKit
• Nuxt / Vue
• Hono (Cloudflare Workers, Bun, Deno)
• Express
• Fastify
• Astro
• NestJS
• SolidStart
• TanStack Start
• React Native / Expo
• Electron

Database Adapters

Built-in: SQLite, PostgreSQL, MySQL, Cloudflare D1

Plugin: Prisma (share an existing PrismaClient)

Enterprise

• Organizations with RBAC
• SCIM directory sync
• Admin controls (ban, impersonate)
• API key management
• Multi-tenant isolation
• GDPR: export, delete, anonymize
• Compliance reports: EU AI Act, NIST, SOC 2, ISO 42001

Edge Runtimes

• Cloudflare Workers (D1, KV)
• Vercel Edge Functions
• Deno Deploy
• Bun
• Three runtime dependencies: drizzle-orm, jose, zod

---

Quick start by framework

npm install @glinr/theauth @glinr/theauth-nextjs

// app/api/auth/[...theauth]/route.ts
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createNextAuthHandler } from "@glinr/theauth-nextjs";

const kavach = createKavach({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword()],
});

const handler = createNextAuthHandler(kavach);
export { handler as GET, handler as POST };

// app/dashboard/page.tsx (Server Component)
import { getServerSession } from "@glinr/theauth-nextjs";

export default async function Dashboard() {
  const session = await getServerSession();
  if (!session) redirect("/sign-in");
  return <h1>Hello, {session.user.email}</h1>;
}

See examples/nextjs-app for a full working example.

npm install @glinr/theauth @glinr/theauth-sveltekit

// src/hooks.server.ts
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createSvelteKitHandler } from "@glinr/theauth-sveltekit";

const kavach = createKavach({
  database: { provider: "sqlite", url: "kavach.db" },
  plugins: [emailPassword()],
});

export const handle = createSvelteKitHandler(kavach);

// src/routes/+layout.server.ts
import { getSession } from "@glinr/theauth-sveltekit";

export async function load(event) {
  const session = await getSession(event);
  return { session };
}

npm install @glinr/theauth @glinr/theauth-nuxt

// server/plugins/theauth.ts
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";

export const kavach = createKavach({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword()],
});

// nuxt.config.ts
export default defineNuxtConfig({
  modules: ["@glinr/theauth-nuxt"],
});

npm install @glinr/theauth @glinr/theauth-hono

import { Hono } from "hono";
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";

type Env = { DATABASE_URL: string };
const app = new Hono<{ Bindings: Env }>();

app.use("/api/auth/*", async (c, next) => {
  const kavach = createKavach({
    database: { provider: "postgres", url: c.env.DATABASE_URL },
    plugins: [emailPassword()],
  });
  return createHonoAdapter(kavach)(c, next);
});

export default app;

See examples/hono-server and examples/cloudflare-workers.

---

Documentation

Primary docs: docs.theauth.dev

Section	Link	What you will find
Getting Started	docs.theauth.dev/docs/quickstart	Installation, first auth flow
Authentication	docs.theauth.dev/docs/auth	All auth methods and plugins
Agent Identity	docs.theauth.dev/docs/agents	Agent tokens, delegation, policies
Permissions	docs.theauth.dev/docs/permissions	RBAC, wildcard matching, ReBAC
MCP OAuth 2.1	docs.theauth.dev/docs/mcp	MCP auth server setup
Framework Adapters	docs.theauth.dev/docs/adapters	Next.js, Hono, SvelteKit, etc.
API Reference	docs.theauth.dev/docs/api	Config, types, errors
Security	SECURITY.md	Threat model, disclosure policy

---

Framework adapters

Package	Framework	Directory
@glinr/theauth-nextjs	Next.js 15 (App Router)	packages/adapters/nextjs
@glinr/theauth-nextjs-auth	Next.js (external auth backend)	packages/adapters/nextjs-auth
@glinr/theauth-hono	Hono (Workers, Bun, Deno)	packages/adapters/hono
@glinr/theauth-express	Express	packages/adapters/express
@glinr/theauth-fastify	Fastify	packages/adapters/fastify
@glinr/theauth-sveltekit	SvelteKit	packages/adapters/sveltekit
@glinr/theauth-nuxt	Nuxt / Vue 3	packages/adapters/nuxt
@glinr/theauth-astro	Astro	[packages/adapters/astro](https://github.com/glincker/theauth/tree/ma