AU
v1.2.4@gablura/auth-core
Production-ready authentication core for Express.js backends. Dual-token RS256 JWT architecture with session binding, token rotation, 2FA, account lockout, and audit logging.
View →
Documentation
Overview
@gablura/auth-next is a complete authentication solution for Next.js applications using NextAuth.js. It provides drop-in components (login/register forms, email verification, password reset), React hooks for form logic, API route handlers, and a bridge layer for secure communication with the @gablura/auth-core backend. Supports credentials login, Google OAuth, TOTP-based 2FA, and full email lifecycle (verification, forgot password, reset).
Why it exists
Setting up NextAuth.js from scratch with credentials provider, JWT callbacks, token exchange with a backend, email verification, password reset, and 2FA is a multi-day effort with many security pitfalls. Auth-next exists to make this a one-line integration. It handles the entire auth flow: form validation (Zod + react-hook-form), argon2 password hashing, HMAC-signed backend communication, automatic token refresh, session management, and all the UI components you need. You configure it once and get a production-ready auth system.
Features
Drop-in NextAuth.js configuration via createAuthOptions()
Credentials provider with argon2 password verification
Google OAuth provider (optional)
TOTP-based two-factor authentication
Email verification flow (24h expiry tokens)
Password reset flow (1h expiry tokens)
HMAC-signed backend communication bridge
Automatic token refresh (60s before expiry)
React hooks for all auth forms (login, register, forgot/reset password)
Pre-built UI components (AuthPage, AuthForm, ForgotPassword, ResetPassword, VerifyEmail)
Composable form sub-components (Header, Fields, Buttons, Footer)
API route handlers (register, verify-email, forgot-password, reset-password)
Zod validation on all inputs
Rate limiting support on registration
Account lockout integration with auth-core
Session timeout detection
TypeScript types extended from NextAuth
ESM-first with tree-shaking
Version
v1.2.4
License
MIT
Status
published