ajo

Ecosystem

Authentication and access

Sessions, CSRF protection, guards and scoped API tokens.

Install and configure auth

Configure the database accessor once, run the auth migrations and register root middleware.

Terminal
pnpm add ajo-kit-auth@0.6.1
pnpm exec kit migrate up

Attach the request identity

Session middleware populates req.user. Explicit bearer credentials authenticate /api/* and take precedence over cookies there. Unsafe cookie-authenticated writes use CSRF protection.

src/wares.ts
import { configure, wares } from 'ajo-kit-auth'
import { db } from '/src/data'

configure(() => db())
export default [wares.session(), wares.csrf]

Authorize the resource

protect() redirects guests. authorize(req, ...abilities) checks global authority. For an exact App or other subject, admit() also checks the scoped token and current account or team grants. Applications still own query filtering; authentication does not grant access to every row.

Inside an API handler
import { admit } from 'ajo-kit-auth'

await admit(req, 'app:journal', 'apps:deploy')

Configure production secrets

Set APP_URL to the trusted public origin. APP_SECRET needs at least 32 random characters from your secret manager for verification links. Keep secrets in the host environment, outside source and build contexts. Production refuses missing, weak or sample secrets. Session and API token plaintext is not stored in the database.

Keep exploringFull reference on GitHub All guides