Auth for TypeScript, done right.
Himayah is a lightweight, schema-first authentication framework. You own your database, your schema, and your code. We handle the hard parts.
import { createAuth } from "@himayah/core";
import { createJWTSessionStore } from "@himayah/session";
import { passwordPlugin } from "@himayah/plugin-password";
import { drizzleAdapter } from "@himayah/adapter-drizzle";
export const auth = createAuth({
adapter: drizzleAdapter(db, { users }),
sessionStore: createJWTSessionStore({
secret: process.env.AUTH_SECRET!,
}),
plugins: [
passwordPlugin({ getPasswordHash, setPasswordHash }),
],
baseUrl: process.env.APP_URL!,
});Everything you need, nothing you don't
Himayah ships with production-grade security defaults and a composable plugin system.
AES-256-GCM Sessions
Stateless JWE sessions encrypted client-side. Zero database round-trips on every request.
Plugin Composable
Mix and match password, OAuth, magic link, OTP, passkeys, and organizations. Pay only for what you use.
Bring Your Own Schema
Define your tables with Drizzle, Prisma, or Kysely. Himayah never owns your migrations.
Runs Anywhere
Cloudflare Workers, Vercel Edge, Deno, Bun, Node.js. Pure Web Crypto — no native bindings.
Secure by Default
CSRF double-submit, constant-time comparisons, PKCE for OAuth, host-header spoofing protection.
Type-Safe Client
First-class TypeScript throughout. The browser client is a fully typed proxy of your server config.
How does Himayah compare?
Different tools for different needs. Here's an honest look at the tradeoffs.
| Feature | Himayah | NextAuth.js | Lucia | Auth.js |
|---|---|---|---|---|
| Schema ownership | ✅ Always yours | ⚠️ Adapter needed | ✅ Always yours | ⚠️ Adapter needed |
| Edge runtime | ✅ Native | ⚠️ Partial | ✅ Native | ✅ Native |
| Plugin composability | ✅ Full | ⚠️ Limited | ❌ DIY | ⚠️ Limited |
| Built-in OTP/Magic Link | ✅ Yes | ❌ No | ❌ No | ❌ No |
| Built-in Organizations | ✅ Yes | ❌ No | ❌ No | ❌ No |
| PKCE for OAuth | ✅ Yes | ✅ Yes | ❌ DIY | ✅ Yes |
| Framework agnostic | ✅ Yes | ❌ Next.js only | ✅ Yes | ✅ Yes |
Ready to add auth to your app?
Follow the getting started guide and have authentication running in under 10 minutes.
Get Started for free →