A route establishes a session. Everything after it is an ordinary service.
$ npm i @frontierjs/auth
Register · login · logout · password reset · email verify
Login cannot be gated by login, so these five are raw routes and always will be. Everything past that line is a service with the normal pipeline over it.
cookieAuth: true authenticates end to end
One session works for a fetch, for a browser navigation and for an OAuth callback — which is a redirect, and cannot carry a bearer header.
The flow engine is split from the transport
Building the URL, trading the code and normalizing the identity are one module with no HTTP, no database and no session in it. The plugin owns the routes; the provider list is data.
TOTP, base32 and recovery codes — clockless
RFC 6238 with the instant as a parameter rather than a read of the clock, so a code is testable and a drifting device is a value you pass in.
account · sessions · api-keys
What a signed-in person does next is not a route. Three ordinary services, gated like everything else, so there is no second authorization story for account management.
Two .lite files, split by who owns them
User is appended into your own schema so you can edit it; the machinery models are imported, so an upgrade reaches an installed app. extend model adjusts them at your end rather than by pasting.
extend model User {
company String?
}Four awaited callbacks; a throw refuses the call
Each one runs BEFORE the thing it can refuse, so declining a registration is returning early rather than undoing a write.
The rest of the stack