Authentication is the foundation of every modern application – whether it's a single-page app or a distributed microservice system. It's the first building block that must be in place before anything else can be built. That's exactly where holeauth comes in.
holeauth is a fully modular authentication framework for TypeScript that integrates cleanly with Next.js, Express, Hono, and other frameworks. Sessions, JWT, passwords, 2FA, passkeys, RBAC, and a full OIDC identity provider – all as individual, composable packages.
The project is currently still in active development. New modules, documentation, and integrations are being added continuously.
In an era where AI assistants like Copilot or Claude write large portions of code, a consistent auth framework saves significant time and budget: instead of rebuilding auth logic from scratch or maintaining error-prone custom implementations, holeauth provides a well-thought-out foundation that's ready to use immediately and integrates into any new stack in just a few lines.
Features
- Sessions & JWT – secure, configurable token management
- Passwords & 2FA – TOTP, email OTP, and more
- Passkeys / WebAuthn – passwordless authentication to current standards
- RBAC – role-based access control out of the box
- OIDC Identity Provider – full IDP for federated authentication
- Edge-native – runs in Next.js Edge Runtime, Cloudflare Workers, and more
Motivation
Modern AI-assisted development workflows generate code faster than ever – but auth logic remains complex and security-critical. holeauth ensures this part of the application is solid, tested, and maintainable, regardless of how the rest of the stack was built.