ModularAuth-Kit — Drop-in Auth for Express.js

server.ts

// That's it. 3 lines to add auth to your project.
import { createConfig, createAuthModule } from './auth/index.js';

const config = createConfig({ session: { secure: false } });
app.use('/auth', createAuthModule(config));
        

Features

Everything you need. Nothing you don't.

All features are disabled by default. Enable only what your project needs — zero bloat.

🔐

Email & Password Auth

📱

Session Management

Server-side sessions with httpOnly cookies. List and revoke devices.

🔑

Password Recovery

Forgot password flow with secure, hashed, single-use tokens.

✉️

Email Verification

6-digit OTP verification. Console adapter for dev, Nodemailer for prod.

🌐

Google OAuth 2.0

No Passport.js. Direct implementation with automatic account linking.

📊

Login History

Track every login with device info, IP address, and timestamps.

🔒

Account Lockout

Temporary lock after failed attempts. Auto-expires, no admin needed.

📝

Audit Logging

Structured JSON logs for every auth event. Debug and monitor easily.

🛡️

OWASP Compliant

Helmet, CSRF protection, enumeration prevention, rate limiting.

How It Works

Three steps. That's it.

Download

Download the latest release from GitHub Releases. Copy src/auth/ into your project — you own the code.

Configure

Call createConfig() with the features you need. Everything is opt-in. Add SESSION_SECRET to your .env.

Mount

One line: app.use('/auth', createAuthModule(config)). Your existing MongoDB connection and routes are untouched.

Why

Stop rewriting auth from scratch.

Every Express project needs auth. Why write 500+ lines every time?

✕ Without ModularAuth-Kit

auth.ts — you write all of this

// User model, password hashing, session store,
// login controller, register controller,
// forgot-password, reset-password, email service,
// CSRF middleware, rate limiter, cookie config,
// session rotation, account lockout logic,
// Google OAuth flow, input validation,
// error handling, audit logging...
//
// 500+ lines. Every. Single. Project.
// And you still forget enumeration protection.
            

✓ With ModularAuth-Kit

server.ts — you write this

import { createConfig, createAuthModule } from './auth/index.js';

const config = createConfig({
  session: { secure: false },
  passwordRecovery: { enabled: true },
  emailVerification: { enabled: true },
  loginHistory: { enabled: true },
  sessionManagement: { enabled: true },
  security: {
    accountLockout: { enabled: true },
  },
});

app.use('/auth', createAuthModule(config));
            

🤖 AI-Powered

Let your AI agent do the integration.

Paste a single prompt to your AI coding agent (Cursor, Copilot, Gemini). The agent analyzes your project, asks what you need, and wires everything up automatically.

0 AI checks if your project is compatible (Express + MongoDB)

1 AI reads your project files — understands structure, deps, DB setup

2 Asks only what it can't figure out from the code

3 Installs missing deps, configures, mounts, verifies — done

Get the AI Prompt →

AI agent output

✅ I've analyzed your project:
  • Express 5.x found in src/app.ts
  • MongoDB connected via mongoose.connect()
  • Missing deps: argon2, zod

✅ Installed 2 packages
✅ Added SESSION_SECRET to .env
✅ Added 4 lines to src/app.ts
✅ TypeScript: 0 errors
✅ Server started on :3000
✅ POST /auth/register — 201
✅ POST /auth/login — 200
✅ GET  /auth/me — 200

Auth is ready. 16 endpoints available.
          

Auth that just works.