theAuth

Most auth libraries stop at human sign-in. Once an AI agent needs its own identity, scoped permissions, delegation from a user, and an audit trail, you end up bolting a second system on. theAuth puts agents and humans in one library: sign-in methods, an OAuth 2.1 authorization server for MCP, and agent tokens with permissions you can check and audit.

It runs on Node, Bun, Deno and Cloudflare Workers with three runtime dependencies (drizzle-orm, jose, zod). MIT licensed. No hosted service required.

theAuth implements OAuth 2.1 with PKCE, DPoP, MCP authorization and OpenID Connect, with about 3,900 test cases and CodeQL on every pull request. Versions below 1.0 can still change between minor releases, and the changelog lists every breaking change.