Works with the login you already have

minidauth runs next to your identity provider. Your users keep signing in the way they do today, and the key that encrypts and signs, along with the decision about who holds a role, moves out of your servers.

The minidauth half is the same file in every integration. Each one is three steps: store one field the user can't edit, add one callback route, and read roles from minidauth instead of from your own tables.

Integrations

Run end to end

Clerk

Clerk keeps the login, including its sign-in component. minidauth adds a key that no single server holds and roles that only a quorum of your admins can grant.

Run end to end

Auth0

Auth0 keeps the login. minidauth adds a key that no single server holds and roles that only a quorum of your admins can grant. The Auth0 token never carries a role.

Run end to end

Supabase

Supabase keeps the login and the database. minidauth adds a key that no single server holds, so sensitive columns hold ciphertext, and roles that only a quorum of your admins can grant.

Setup scripted

Amazon Cognito

Cognito keeps the login. minidauth adds a key that no single server holds and roles that only a quorum of your admins can grant. The Cognito token never carries a role.

Runs locally

Better Auth

Better Auth keeps accounts, sessions and passwords, exactly as it would on its own. minidauth adds a key that no single server holds and roles that only a quorum of your admins can grant.

Not on this list? The same pattern works with anything that gives you a stable user id. If you can't add a column, key the mapping on the id you already have.