VaultAuth
A reusable authentication foundation for developers who don't want to rebuild login, sessions, roles, permissions, password changes and admin access from scratch for every new application.
Stop rebuilding authentication from scratch.
VaultAuth packages the recurring authentication concerns of a modern web application into a starter system that can be adapted to a product instead of recreated for every project.
Access + refresh tokens
Short-lived access JWTs are kept in Redux memory while refresh tokens use an
httpOnly cookie and Redis-backed token allow-listing.
Coarse and fine-grained access
Role middleware handles broad access such as admin, while permission
and attribute checks support finer-grained authorization decisions.
Separate work from requests
BullMQ moves background jobs away from the request path, while Node cluster can run one worker process per CPU core in production.
Beautiful login experience.
A clean, modern and distraction-free login page built with Next.js 14 and Tailwind CSS. The frontend gives developers a working authentication experience instead of leaving the UI layer to be assembled later.
Login · Next.js 14
Dashboard · Account security
A focused developer dashboard.
The included dashboard provides the essential account information and security controls without adding unnecessary product-specific complexity.
Powerful admin controls.
Admin-only user management is part of the supplied application flow. The protected user list demonstrates how role-based access can control administrative functionality.
Admin · User management
Short-lived access. Rotating refresh sessions.
The documented default is a 15-minute access token and a 7-day refresh token, with Redis-backed refresh-session allow-listing.
Access tokens are short-lived JWTs kept in Redux memory rather than localStorage.
Refresh tokens are longer-lived JWTs stored in an httpOnly cookie,
allow-listed in Redis by a per-token jti, and rotated on use.
RBAC when roles are enough. ABAC when they aren't.
RBAC provides the coarse-grained role boundary documented by the project, while ABAC supports permission claims and runtime predicates such as resource ownership.
user and admin rolesAuthentication with clear boundaries.
Request handling, authentication, authorization, persistence and background work are kept as distinct pieces of the system.
Keep request handling independent from background work.
Registration can enqueue a welcome-email job rather than performing the work inside the request. The separate worker can scale independently from the API.
In production mode, Node cluster can fork one worker process per CPU core and restart a worker after a crash.
Built from familiar production components.
The current repository uses a Node.js backend and a Next.js frontend with explicit infrastructure boundaries.
Core authentication endpoints.
These are the routes documented by the current VaultAuth README.
| Method | Route | Auth | Purpose |
|---|---|---|---|
| POST | /api/auth/register | — | Create account and return tokens |
| POST | /api/auth/login | — | Authenticate a user |
| POST | /api/auth/refresh | Cookie | Rotate refresh token |
| POST | /api/auth/logout | Bearer | Revoke current session |
| POST | /api/auth/logout-all | Bearer | Revoke all user sessions |
| GET | /api/auth/me | Bearer | Return current user profile |
| POST | /api/auth/change-password | Bearer | Change password and revoke other sessions |
| GET | /api/users | Bearer + admin | List all users |
| PATCH | /api/users/:id/role | Bearer + admin | Change a user's role |
Use the right production configuration.
The README calls out several production settings that should be applied before deploying the system publicly.
COOKIE_SECURE=true with HTTPSBuild on a foundation, not from scratch.
VaultAuth is being developed as a reusable authentication starter for developers who want a structured starting point for new applications.
It is still in development and will be shortly available to all users.