awesome-lang-auth
One self-hosted auth model for your servers and your clients: JWT sessions with refresh-token rotation, OAuth2, magic links and two-factor authentication, on your own infrastructure, with no per-user pricing.
npm i @awesome-lang-auth/nodeThe reference implementation: a drop-in auth router for Express, NestJS and Next.js. Formerly published as awesome-node-auth.
Every server also serves auth.js: any frontend, one script tag
Mix and match: any server, any client
Every server in the family serves the same wire protocol, and every client speaks it. Pick a server for your stack and a client for your app: only the base URL changes.
Servers
- Node.js
- Go
- AWS Lambda
- Python
- Rust
- Dart
Clients
- Angular
- React
- Flutter
- Vanilla JS
// Angular: @awesome-lang-auth/angular
provideAuth({ apiPrefix: '/api/auth' })
// React: @awesome-lang-auth/react
<AwesomeAuthProvider options={{ apiPrefix: '/api/auth' }}>
// Flutter: awesome_flutter_auth
AuthClient(AuthOptions(apiPrefix: '/api/auth'))
// Any web page: auth.js, served by the server itself
AwesomeNodeAuth.init({ apiPrefix: '/api/auth' })apiPrefix is the only line that knows which server answers. In the browser the clients use HttpOnly cookies and a CSRF header, so serve the API from your app's origin (a reverse-proxy rule is enough); native apps use bearer tokens. Checked end to end: the awesome-lambda-auth examples (opens in a new tab) run the unmodified Angular and Flutter clients against a deployed Lambda stack. The two Flutter client gaps they surfaced, the sessions list and 2FA setup on servers that send no QR image, are tracked in #21 (opens in a new tab) and #22 (opens in a new tab).
Built into every server
Any frontend, one script tag
Every server in the family serves auth.js, a complete browser auth client, together with the ready-made, customizable auth UI pages. Load it and any frontend gets login, token refresh, the CSRF header and every auth flow, with no npm install and no build step.
<script src="/auth/ui/auth.js"></script>The path is <apiPrefix>/ui/auth.js. /auth is the default prefix on every server except Python (/api/auth); with another prefix, also call AwesomeNodeAuth.init({ apiPrefix }). For an API on another origin, use its full URL in src and in apiPrefix (headless mode).
- Plain HTML
- Vue
- Svelte
- jQuery
- any framework
Served by every server
- Node.js
- Go
- AWS Lambda
- Python
- Rust
- Dart
GET /auth/ui/auth.js- the browser client,
window.AwesomeNodeAuth GET /auth/ui/login- the built-in UI pages
Routes with the default prefix. Switch the built-in UI on: one setting in Node.js, Go and Lambda, one mounted router in Python. Rust and Dart serve it by default.
Any database
The libraries persist nothing on their own. Users go through one contract that your application implements for the database it already has; optional contracts add features such as roles, API keys and telemetry.
The user store, in each language
- Node.js
IUserStoreinterface - Go
UserStoreinterface - Python
UserStoreabstract class - Rust
UserStoretrait - Dart
UserStoreinterface - AWS Lambdaships DynamoDB stores
Guides and examples (Node.js)
How the store contract works →One auth system. Backend + frontend ecosystem.
Server libraries for Node.js, Go, Python, Rust and Dart, a deployable AWS Lambda stack, and client libraries for Angular, React and Flutter, plus auth.js and the served UI for any web framework. The badge says how far each one is today.
Servers
The reference library, and the wire protocol every other member speaks. Drop-in auth router for Express, NestJS, Next.js and Angular SSR. Formerly published as awesome-node-auth.
npm i @awesome-lang-auth/nodeGo port of the reference: the same auth endpoints and JWT contract, served through adapters for net/http, chi, gin and echo. The module path moves to github.com/awesome-lang-auth/awesome-go-auth at v1.0.0.
go get github.com/nik2208/awesome-go-auth@v0.12.0A self-hosted alternative to Amazon Cognito, deployed in your own AWS account. It runs the Go core unchanged and keeps the same wire protocol.
git clone https://github.com/awesome-lang-auth/awesome-lambda-authFastAPI library with the same auth flows as the reference: cookie and bearer sessions, CSRF, IdP mode, RBAC and multi-tenancy.
pip install awesome-python-authFramework-agnostic crate with the same auth model: RBAC, tenancy, event bus, API keys and IdP/JWKS support. Features for Axum, Actix-web and Warp.
cargo add awesome-rust-auth --git https://github.com/awesome-lang-auth/awesome-rust-authServer-side core that serves Shelf directly, with a Dart Frog adapter package in the same repository, and the same auth model as the reference: cookies and CSRF for the web, bearer for native apps.
dart pub add awesome_dart_auth --git-url https://github.com/awesome-lang-auth/awesome-dart-auth --git-path packages/awesome_dart_authClients and browser script
Angular library with guards, HttpClient interceptors, reactive session signals, CSRF support and SSR-safe setup. Formerly published as ng-awesome-node-auth.
npm i @awesome-lang-auth/angularReact 18 and 19 bindings: one provider, one hook and two route gates, SSR-safe. Cookies on the web, bearer tokens on React Native.
npm i @awesome-lang-auth/reactFlutter client with no token boilerplate: cookies and CSRF on web and WASM, bearer tokens on iOS, Android and desktop. Formerly published as awesome_node_auth_flutter.
flutter pub add awesome_flutter_authA browser client in one script tag, served next to the built-in UI pages. No build step: login, token refresh and every auth flow from window.AwesomeNodeAuth. Served by every server; works with Vue, Svelte, plain HTML.
<script src="/auth/ui/auth.js"></script>- stable
- Released on its registry with 1.x versions
- beta
- Released on its registry; 0.x, the API may still change
- preview
- Installed from its git repository; no registry release yet
- early
- First 0.x release on its registry
Why awesome-lang-auth?
awesome-lang-auth started as awesome-node-auth, the simple answer to the management complexity and enterprise subscriptions often required for best-practice authentication, and has since grown into a multi-language family.
The same auth model and wire protocol now span Node.js (the reference), Go, Python/FastAPI, Rust and Dart/Shelf backends, plus a serverless AWS Lambda stack built on the Go core. On the client side there are Angular, React and Flutter libraries, and any browser framework can use auth.js and the built-in served UI.
Solutions like Supertokens are extremely complex, paid if managed, and limited or hard to maintain if self-hosted. Supabase is heavy, packed with features you're forced to carry along even if you don't need them, and similarly limited when self-hosted.
awesome-lang-auth gives you the same enterprise-grade features without the architectural bloat or vendor lock-in of cloud platforms, in your language of choice.
| Feature | awesome-lang-auth | Others |
|---|---|---|
| Database support | Any DB via store interfaces (Lambda: DynamoDB) | Specific DBs only |
| Auth strategies | 5+ built-in recipes | Varies |
| Self-hosted | ✅ Always | Paid tier or limited |
| JWT tokens | ✅ Access + refresh pair | Often session-only |
| Official backend libraries | Node · Go · Python · Rust · Dart, plus an AWS Lambda stack | ❌ or third-party only |
| Official frontend libraries | Angular · React · Flutter · auth.js + served UI (any framework, headless/headful) | ❌ or third-party only |
| License | MIT | Mixed |
Choose your recipe
Pick the authentication strategy that fits your app. Mix and match multiple recipes.
Email / Password
Classic email and password authentication with bcrypt hashing and password reset flow.
View docs →OAuth / Social
Sign in with Google, GitHub, or any custom OAuth 2.0 provider using GenericOAuthStrategy.
View docs →Magic Link
Passwordless login via email. First magic-link login counts as email verification.
View docs →SMS OTP
One-time password codes delivered via SMS for phone verification or 2FA.
View docs →TOTP 2FA
Time-based one-time passwords compatible with Google Authenticator and Authy.
View docs →Multi-Tenancy
Isolate users and data across multiple tenants with tenant-aware RBAC.
View docs →Admin Panel
Self-contained admin dashboard: user management, sessions, roles, tenants, and policy controls.
View docs →Account Linking
Link multiple OAuth providers to one account. Safe conflict resolution via IPendingLinkStore.
View docs →Event Bus & Tracking
Publish and subscribe to auth events (login, signup, failure…) with AuthEventBus. Track telemetry with a single tools.track() call.
View docs →Real-time SSE
Push live notifications to connected browsers via Server-Sent Events. No WebSocket server needed.
View docs →Webhooks
Forward auth events to external services with HMAC-signed outgoing webhooks and scripted inbound webhooks.
View docs →Telemetry
Persist every auth event to any database via ITelemetryStore and query the history through the tools router.
View docs →Cloud Scalable
Stateless architecture by design. Use ISseDistributor and Redis to scale real-time SSE across any number of instances.
View docs →Python / FastAPI
Official Python backend library — same auth flows, CSRF, IdP mode, RBAC, and multi-tenancy as the Node.js library.
View docs →Dart / Shelf backend
Official Dart backend for Shelf and Dart Frog, with the same auth model as Node.js: cookies, CSRF, OAuth, magic link, RBAC, and IdP mode.
View docs →Rust backend
Official Rust crate for Axum, Actix-web, and Warp — same auth model, RBAC, tenancy, event bus, API keys, and IdP/JWKS support.
View docs →Flutter client
Official Flutter/Dart client — automatic cookie+CSRF on web/WASM and Bearer on native. Zero token-management boilerplate.
View docs →