theAuth

Open-source auth for AI agents and humans.
Agent identity, delegation, MCP OAuth 2.1 server, DPoP, passkeys, device flow. A self-hostable Better Auth alternative for TypeScript.

Website · Quickstart · Docs · Examples · Discussions · GLINR Discord

What it is

Most auth libraries stop at human sign-in. Once an AI agent needs its own identity, scoped permissions, delegation from a user, and an audit trail, you end up bolting a second system on. theAuth puts agents and humans in one library: sign-in methods, an OAuth 2.1 authorization server for MCP, and agent tokens with permissions you can check and audit.

It runs on Node, Bun, Deno and Cloudflare Workers with three runtime dependencies (drizzle-orm, jose, zod). MIT licensed. No hosted service required.

30 second quickstart

Runs as pasted with SQLite. Needs Node 20 or newer.

npm install @glinr/theauth

import { createTheAuth, users } from "@glinr/theauth";

const auth = await createTheAuth({
  database: { provider: "sqlite", url: ":memory:" },
  agents: { enabled: true }, // creates the agent and audit tables
});

// Agents need an owner row in theauth_users (human auth creates these for you).
auth.db.insert(users).values({
  id: "user-123", email: "owner@example.com", name: "Owner",
  createdAt: new Date(), updatedAt: new Date(),
}).run();

const agent = await auth.agent.create({
  ownerId: "user-123",
  name: "github-reader",
  type: "autonomous",
  permissions: [{ resource: "mcp:github:*", actions: ["read"] }],
});
console.log(agent.token); // "kv_..." shown once

const { allowed } = await auth.authorize(agent.id, { action: "read", resource: "mcp:github:repos" });
console.log(allowed); // true

Agent tokens start with kv_. The prefix predates the rename from Kavach and stays so issued tokens keep working (RENAME-MAP.md).

To mount it over HTTP, pick an adapter such as @glinr/theauth-hono or @glinr/theauth-nextjs (framework snippets below). To add email and password, install @glinr/theauth-email. Full walkthrough: docs.theauth.dev/quickstart. Or scaffold an app: npm create @glinr/theauth-app.

What is merged today

The token policy, RFC 9396 rich authorization requests and ID-JAG pieces live in the Go SDK, not here. See theauth-go.

17 providers: Apple, Atlassian, Discord, Dropbox, Figma, GitHub, GitLab, Google, LinkedIn, Microsoft, Notion, Reddit, Slack, Spotify, Twitch, Twitter/X, Zoom.

Frameworks and adapters

Hono, Next.js, SvelteKit, Nuxt, Express, Fastify, Astro, NestJS, SolidStart, TanStack Start, plus clients for React, Vue, Svelte, Expo and Electron. Databases: SQLite, PostgreSQL, MySQL, Cloudflare D1, and Prisma through @glinr/theauth-prisma.

npm install @glinr/theauth @glinr/theauth-nextjs

// app/api/theauth/[...theauth]/route.ts
import { createTheAuth } from "@glinr/theauth";
import { theAuthNextjs } from "@glinr/theauth-nextjs";

const auth = await createTheAuth({
  database: { provider: "postgres", url: process.env.DATABASE_URL! },
});

// `authenticate` resolves the caller from the request. See the adapter docs.
export const { GET, POST, PATCH, DELETE, OPTIONS } = theAuthNextjs(auth, { authenticate });

npm install @glinr/theauth @glinr/theauth-hono

import { Hono } from "hono";
import { createTheAuth } from "@glinr/theauth";
import { theAuthHono } from "@glinr/theauth-hono";

const auth = await createTheAuth({
  database: { provider: "postgres", url: process.env.DATABASE_URL! },
});

const app = new Hono();
app.route("/api/theauth", theAuthHono(auth, { authenticate }));

export default app;

Every adapter has the same shape. Per-framework docs: docs.theauth.dev/adapters.

How theAuth compares

Checked against each vendor's public docs on 2026-10-07. Vendors change fast, so verify against their docs. Write-ups with sources: theauth.dev/compare.

Where theAuth is the weaker choice: Better Auth has a larger community, more tutorials and a bigger plugin catalog. Auth0 and Clerk are managed products with hosted UIs and support contracts, which we do not match. Pick theAuth when agents are first-class users of your system and you want to run the whole thing yourself. Migration guides: migrate-from-auth0, migrate-from-better-auth-agent-plugin.

Packages

All packages live in this monorepo and publish under @glinr/.

Example apps

nextjs-app, nextjs-demo, hono-server, cloudflare-workers, mcp-server, scim-okta, basic-agent, migrate-from-auth0, migrate-from-better-auth-agent-plugin.

Docs and community

• Docs: docs.theauth.dev, with agents, MCP, permissions and the API reference.
• Questions and ideas: GitHub Discussions or the #theauth forum channel in the GLINR Discord.
• Hosted option: theAuth Cloud is in early access, see theauth.dev/pricing.
• Changes: CHANGELOG.md.

Contributing

See CONTRIBUTING.md. Issues labeled good first issue are a good start. By contributing you agree to the Code of Conduct.

Security

Report vulnerabilities privately to support@glinr.com or through the GitHub advisory form. Do not open a public issue. Details in SECURITY.md.

License

MIT

Made by GLINCKER

theAuth is built in the open by GLINCKER, a GLINR STUDIOS company. Founder: thegdsks. Sibling projects: LevelRail, theSVG, GLINUI.