Easy

Built in support for popular services (Google, Facebook, Auth0, Apple…) Built in email / passwordless / magic link Use with any username / password store Use with OAuth 1.0 & 2.0 services

Flexible

Built for Serverless, runs anywhere Bring Your Own Database - or none! (MySQL, Postgres, MSSQL, MongoDB…) Choose database sessions or JWT Secure web pages and API routes

Secure

Signed, prefixed, server-only cookies HTTP POST + CSRF Token validation JWT with JWS / JWE / JWK / JWK Tab syncing, auto-revalidation, keepalives Doesn't rely on client side JavaScript