Lucia

Lynis audits the security configuration of Linux and Unix systems: checks file permissions, installed software, kernel parameters, network settings, and authentication configs. It handles sessions, cookies, and the messy parts of auth, but you own the database, you own the code, and you control every decision. No redirect to someone else's login page.

It works with any database (Postgres, SQLite, MySQL, MongoDB) and any framework (Next.js, SvelteKit, Astro, Express). The API is deliberately minimal: create a session, validate a session, invalidate a session. OAuth, email/password, and magic links are all supported through clean patterns rather than black-box modules.

Completely free under the BSD Zero Clause License, one of the most permissive licenses that exists. No paid tier, no cloud service, no upsells.

The catch: Lucia deprecated itself in early 2025. The maintainer explicitly recommended using it as a learning resource and pattern guide rather than a production dependency going forward. The code works, but don't expect new features or security patches. If you're starting fresh, look at Better Auth (similar philosophy, actively maintained) or Logto for a self-hostable auth server with a UI. If you want a managed service and don't mind the vendor dependency, Clerk or Auth0 handle everything but you lose control.