生产就绪的身份,
分三行。
OAuth (15 providers), MFA, magic links, granular RBAC. One single SDK, zero opaque redirects, RLS policies that work seamlessly with your Postgres.
'use server'import { aura } from '@/lib/aurabase'export async function signIn(formData: FormData) {const email = formData.get('email') as stringconst password = formData.get('password') as stringconst { data, error } = await aura.auth.signInWithPassword({email, password,mfa: 'required', // enforce TOTP if enrolled})if (error) return { error: error.message }redirect('/dashboard')}
企业身份平台所期望的一切
15 OAuth providers
Google, GitHub, Discord, Facebook, X, Microsoft, Apple, Spotify, Twitch, Bitbucket, Zoom, Notion, Figma, Kakao, Snapchat, plus generic OIDC.
TOTP MFA
Authy/1Password compatible TOTP, single-use recovery codes, optional SMS login fallback.
Magic links & OTP
Passwordless email or 6-digit OTP. Localized email templates, per-address rate limiting, SMS fallback.
Granular RBAC
Roles, permissions, org hierarchies. Postgres policies generated automatically from your RBAC graph.
Bot detection
Behavioral fingerprinting, invisible challenges, IP/device rate-limiting. Blocks 99.7% of credential stuffing.
与用户已经信任的提供商联系
十五个官方维护的 OAuth 提供商。只需从 Studio 中一键点击即可准备好最需要的功能,包括 PKCE、状态验证、CSRF 保护和自动令牌轮换。
专用的、开发人员友好的 REST 界面
/auth/v1/signupCreate an account. Optional email verification./auth/v1/signin/passwordAuthenticate with password, returns session + refresh token./auth/v1/signin/oauth/:providerInitiate PKCE OAuth flow, returns consent URL./auth/v1/magic-linkSend magic link to the specified email address./auth/v1/mfa/enrollTrigger TOTP enrollment for the user./auth/v1/sessionReturn current session and claims./auth/v1/userUpdate user metadata (re-verification required for email)./auth/v1/sessionSign out, revokes server-side refresh token.快速、安全、可审核
Aurabase Auth · Supabase Auth · Auth0 · 职员
常见问题
How does this integrate with Postgres and RLS policies?+
request.jwt.claims 进入 Postgres 会话,允许您的 RLS 策略访问 auth.uid(), 授权角色(), auth.租户() 无需任何应用程序级中间件。Can we connect an in-house IdP or enterprise SSO?+
How are passwords stored?+
Do sessions work on React Native, Tauri, and Electron?+
@aurabase/native 适用于带有操作系统钥匙串绑定的 Tauri/Electron。刷新令牌永远不会离开安全钥匙串。What about audit logs?+
If I leave, what do I get to export?+
用户.jsonl 导出(包括 Argon2id 密码哈希)、您的 OAuth 链接帐户以及纯 SQL 中的 RLS 策略。无需重新实现专有 API——我们的格式与 Auth.js 和 Lucia 兼容。