kavachOS

Install

npm install @glinr/theauth
# or
pnpm add @glinr/theauth
# or
yarn add @glinr/theauth

import { createKavach } from "@glinr/theauth";
import { emailPassword, passkey } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";

const kavach = createKavach({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword(), passkey()],
});

const app = new Hono();
app.route("/api/auth", createHonoAdapter(kavach));

// Create an AI agent with scoped MCP permissions
const agent = await kavach.agent.create({
  ownerId: "user-123",
  name: "github-reader",
  type: "autonomous",
  permissions: [{ resource: "mcp:github:*", actions: ["read"] }],
});

const result = await kavach.authorize(agent.id, {
  action: "read",
  resource: "mcp:github:repos",
});
// { allowed: true, auditId: "aud_..." }

Why theauth

Most auth libraries stop at human sign-in. That leaves you stitching together separate systems when your AI agents need identity, scoped permissions, delegation, and audit trails. theauth handles both in one place.

Features

Authentication

• Email and password with HIBP breach checking
• Magic link
• Email OTP
• Phone SMS OTP
• Passkeys / WebAuthn
• TOTP 2FA (authenticator apps)
• SAML 2.0 and OIDC SSO
• Anonymous sessions
• Google One Tap
• Sign In With Ethereum
• Device Authorization (TV / CLI flows)
• Username and password
• Captcha integration
• Session freshness enforcement

OAuth 2.1

• Authorization Code + PKCE
• Client Credentials
• Device Authorization Grant
• Refresh Token rotation
• Token introspection
• Dynamic Client Registration (RFC 7591)
• Server metadata (RFC 8414)
• Resource indicators (RFC 8707)
• Authorization Server Issuer Identification (RFC 9728)

MCP Support

• Full OAuth 2.1 authorization server for the Model Context Protocol
• PKCE S256 mandatory
• RFC 9728 / 8707 / 8414 / 7591 compliant
• Agent token issuance and validation

AI Agent Identity

• Cryptographic bearer tokens (kv_...)
• Wildcard permission matching
• Delegation chains with configurable depth limits
• Budget policies per agent
• Anomaly detection
• CIBA-style approval flows for sensitive tool calls
• Full audit trail per agent action

Framework Adapters

• Next.js 15 (App Router, Route Handlers, Middleware)
• SvelteKit
• Nuxt / Vue
• Hono (Cloudflare Workers, Bun, Deno)
• Express
• Fastify
• Astro
• NestJS
• SolidStart
• TanStack Start
• React Native / Expo
• Electron

Database Adapters

Built-in: SQLite, PostgreSQL, MySQL, Cloudflare D1

Plugin: Prisma (share an existing PrismaClient)

Enterprise

• Organizations with RBAC
• SCIM directory sync
• Admin controls (ban, impersonate)
• API key management
• Multi-tenant isolation
• GDPR: export, delete, anonymize
• Compliance reports: EU AI Act, NIST, SOC 2, ISO 42001

Edge Runtimes

• Cloudflare Workers (D1, KV)
• Vercel Edge Functions
• Deno Deploy
• Bun
• Three runtime dependencies: drizzle-orm, jose, zod

Quick start by framework

npm install @glinr/theauth @glinr/theauth-nextjs

// app/api/auth/[...theauth]/route.ts
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createNextAuthHandler } from "@glinr/theauth-nextjs";

const kavach = createKavach({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword()],
});

const handler = createNextAuthHandler(kavach);
export { handler as GET, handler as POST };

// app/dashboard/page.tsx (Server Component)
import { getServerSession } from "@glinr/theauth-nextjs";

export default async function Dashboard() {
  const session = await getServerSession();
  if (!session) redirect("/sign-in");
  return <h1>Hello, {session.user.email}</h1>;
}

See examples/nextjs-app for a full working example.

npm install @glinr/theauth @glinr/theauth-sveltekit

// src/hooks.server.ts
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createSvelteKitHandler } from "@glinr/theauth-sveltekit";

const kavach = createKavach({
  database: { provider: "sqlite", url: "kavach.db" },
  plugins: [emailPassword()],
});

export const handle = createSvelteKitHandler(kavach);

// src/routes/+layout.server.ts
import { getSession } from "@glinr/theauth-sveltekit";

export async function load(event) {
  const session = await getSession(event);
  return { session };
}

npm install @glinr/theauth @glinr/theauth-nuxt

// server/plugins/theauth.ts
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";

export const kavach = createKavach({
  database: { provider: "postgres", url: process.env.DATABASE_URL },
  plugins: [emailPassword()],
});

// nuxt.config.ts
export default defineNuxtConfig({
  modules: ["@glinr/theauth-nuxt"],
});

npm install @glinr/theauth @glinr/theauth-hono

import { Hono } from "hono";
import { createKavach } from "@glinr/theauth";
import { emailPassword } from "@glinr/theauth/auth";
import { createHonoAdapter } from "@glinr/theauth-hono";

type Env = { DATABASE_URL: string };
const app = new Hono<{ Bindings: Env }>();

app.use("/api/auth/*", async (c, next) => {
  const kavach = createKavach({
    database: { provider: "postgres", url: c.env.DATABASE_URL },
    plugins: [emailPassword()],
  });
  return createHonoAdapter(kavach)(c, next);
});

export default app;

See examples/hono-server and examples/cloudflare-workers.

Documentation

Primary docs: docs.theauth.dev

Framework adapters

Database adapters

SQLite, PostgreSQL, MySQL, and Cloudflare D1 are built into the core package. Use the Prisma adapter to share an existing PrismaClient.

Example apps

TheAuth Cloud

Hosted version with dashboard, billing, and zero infrastructure. app.theauth.dev

Security

Responsible disclosure: see SECURITY.md. Do not open a public issue for vulnerabilities.

Roadmap

Follow development on GitHub Discussions and the changelog.

Contributing

See CONTRIBUTING.md. First-time contributor? Look for issues labeled good first issue.

By contributing, you agree to the Code of Conduct.

License

MIT (c) GLINCKER LLC