Authentication & sessions
Every sign-in path your users expect, plus a server-side session mirror so you can revoke from anywhere. Argon2id passwords, hashed reset tokens, CSRF on every form.
- Email + passwordargon2id, 19 MB / 2 iter
- Google OAuthopenid-connect, OIDC
- GitHub OAuthOAuth 2.0, granular scopes
- Magic link10-min TTL, single-use
- Email verification24-hr token, auto-marked
- Password reset1-hr token, hashed at rest
- Per-device sessionsUA, IP, last seen
- Session revocationserver-side mirror