The Auth Engine You
Actually Own.

const express = require("express");
const devAuthKit = require("devauthkit");

const app = express();

// Initialize DevAuthKit (Zero-config dev mode prints OTP to console)
devAuthKit(app, {
  jwtSecret: process.env.JWT_SECRET || "your-secret-key",
  sessionSecret: process.env.SESSION_SECRET || "your-session-key",
  corsOrigin: ["http://localhost:3000", "http://localhost:5173"],
  devMode: true
});

// Protect routes with triple-strategy requireAuth middleware
app.get("/api/dashboard", devAuthKit.requireAuth, (req, res) => {
  res.json({ message: "Authenticated", user: req.user });
});

app.listen(3000, () => console.log("DevAuthKit server ready on http://localhost:3000"));

import { Hono } from "hono";
import { createHonoAuth, CloudflareD1RefreshTokenStore } from "devauthkit/hono";

const app = new Hono();

export default {
  async fetch(request, env, ctx) {
    const auth = createHonoAuth({
      jwtSecret: env.JWT_SECRET,
      d1: env.DB,
      refreshTokenStore: new CloudflareD1RefreshTokenStore(env.DB)
    });

    app.route("/auth", auth.routes);

    app.get("/api/user", auth.requireAuth, (c) => {
      return c.json({ user: c.get("user") });
    });

    return app.fetch(request, env, ctx);
  }
};

import React from "react";
import { AuthProvider, useAuth } from "devauthkit/react";

function UserProfile() {
  const { user, isAuthenticated, sendOTP, verifyOTP, logout } = useAuth();

  if (!isAuthenticated) {
    return <button onClick={() => sendOTP("user@dev.io")}>Login with OTP</button>;
  }

  return (
    <div>
      <h2>Account: {user.email}</h2>
      <button onClick={logout}>Sign Out</button>
    </div>
  );
}

export default function App() {
  return (
    <AuthProvider>
      <UserProfile />
    </AuthProvider>
  );
}