Hasura Auth

NOTE: This repository is deprecated. All development has moved to https://github.com/nhost/nhost

<h1 align="center">Hasura Auth</h1> <h2 align="center">Authentication for Hasura</h2> <p align="center"> <img src="https://img.shields.io/badge/version-2.2.1-blue.svg?cacheSeconds=2592000" /> <a href="LICENSE"> <img src="https://img.shields.io/badge/license-MIT-yellow.svg" alt="license: MIT" /> </a> <a href="https://commitizen.github.io/cz-cli"> <img src="https://img.shields.io/badge/commitizen-friendly-brightgreen.svg" alt="commitizen: friendly" /> </a> <a href="https://prettier.io"> <img src="https://img.shields.io/badge/code_style-prettier-ff69b4.svg" alt="code style: prettier" /> </a> <a href="https://github.com/nhost/hasura-auth/actions?query=workflow%Build+branch%3Amain+event%3Apush"> <img src="https://github.com/nhost/hasura-auth/workflows/Build/badge.svg?branch=main"/> </a> <a href="https://codecov.io/gh/nhost/hasura-auth/branch/main"> <img src="https://codecov.io/gh/nhost/hasura-auth/branch/main/graph/badge.svg" /> </a> </p>

Core Features

• 🧑‍🤝‍🧑 Users are stored in Postgres and accessed via GraphQL
• 🔑 Multiple sign-in methods.
• ✨ Integrates with GraphQL and Hasura Permissions
• 🔐 JWT tokens and Refresh Tokens.
• ✉️ Emails sent on various operations
• ✅ Optional checking for Pwned Passwords.

Sign in methods

• Email and Password - simple email and password method.
• Email - also called passwordless email or magic link.
• SMS - also called passwordless sms.
• Anonymous - sign in users without any method. Anonymous users can be converted to regular users.
• OAuth providers: Facebook, Google, GitHub, Twitter, Apple, Azure AD, LinkedIn, Windows Live, Spotify, Strava, GitLab, BitBucket, Discord, WorkOS.
• Security keys with WebAuthn

Deploy Hasura Auth in Seconds

Use Nhost to start using Hasura Auth in seconds.

Using Docker-compose

git clone https://github.com/nhost/hasura-auth.git
cd hasura-auth/build/docker-compose
docker compose up

Building from Source

git clone https://github.com/nhost/hasura-auth.git
cd hasura-auth
go build -o hasura-auth main.go
./hasura-auth --help

Configuration

Read our configuration guide to customise the Hasura Auth settings.

Workflows

• Email and password
• Oauth social providers
• Passwordless with emails (magic links)
• Passwordless with SMS
• Anonymous users
• Change email
• Change password
• Reset password
• Refresh tokens
• Security keys with WebAuthn

JWT Signing

The JWT tokens can be signed with either a symmetric key based on HMAC-SHA or with asymmetric keys based on RSA. To configure the JWT signing method, set the environment variable HASURA_GRAPHQL_JWT_SECRET which should follow the same format as Hasura with a few considerations:

1. Only HS and RS algorithms are supported.
2. If using RS algorithm, the public key should be in PEM format.
3. If using RS algorithm, the private key should be in PKCS#8 format inside an extra field signing_key.
4. If using RS algorithm, an additional field kid can be added to specify the key id in the JWK Set.

When using asymmetric keys, you can get the JWK Set from the endpoing .well-known/jwks.json.

Recipes

• Extending Hasura's permissions with Custom JWT claims
• Extending the user schema

Reference

• CLI options and configuration available in the CLI documentation.
• The service comes with an OpenAPI definition which you can also see online.
• Database Schema

Show your support

Give a ⭐️ if this project helped you!

📝 License

This project is MIT licensed.