Where do my users’ records live?

In your project’s own provisioned Postgres, in the auth_users, auth_sessions, and auth_passkeys tables. You have full SQL access to them and can join them with your application tables. They are never exposed directly to the browser.

Is there a per-MAU or per-seat charge?

No. Auth is bundled into the flat $20 platform with no per-monthly-active-user meter and no SSO tax at MVP. A fair-use ceiling arrives later as a flat pack, never a per-user cliff.

How do I integrate it?

With the @primdb/auth-node backend SDK: create the client with your project id, then call sign-in and validateRequest. React components and a hosted widget are Phase 2, so the MVP integration is server-side.

In the EU, on Hetzner, with per-project isolation. Not the US, not Vercel. It is already next to the app and database you deploy on PrimDB.

03 · Auth

Auth that lives in your own database.

Sign your users in with email + password, a magic link, or a passkey. Their records land in your own Postgres, so you can join them with your app tables in plain SQL. No per-MAU bill and no SSO tax. Nothing to keep in sync with an outside vendor, because it is already wired to the app and database you deploy here.

Sign-in methods

Every way in, ready today

All of them work today. Turn each one on or off per project from the dashboard.

Email + password

Passwords hashed with bcrypt, lockout after repeated failures, and password reset over a single-use link. None of it hand-rolled.

Magic link

A one-time sign-in link, sent over Resend and rate-limited. It expires fast and cannot be replayed once clicked.

Passkey (WebAuthn)

Sign in with Touch ID, Face ID, or a security key, bound to your domain. Multiple passkeys per user, with magic link as the fallback.

OAuth social (Google, GitHub)

Sign in with Google or GitHub over PKCE + state. We only link a social identity to an existing account on a provider-verified email, so there is no account-takeover path.

Two-factor (authenticator app)

Users add a TOTP authenticator (RFC 6238) plus single-use recovery codes. Once armed, the second factor is required on every sign-in: password, magic link, or social. Secrets are encrypted at rest, codes are hashed and one-time.

Organizations & teams

Multi-tenant B2B for your own app: users create orgs, invite teammates by email with single-use links, and hold owner / admin / member roles. The active org rides in the access token, so your backend authorizes per-org with no extra call. Every query re-asserts project and org membership.

Your data, your database

Your users live in your own Postgres.

The auth_users, auth_sessions, and auth_passkeys tables are provisioned in the project’s own Postgres: the same database you already have. Query and join them like any other table. No vendor lock-in, no export job to get your own users back.

Join auth_users with your application tables in one SQL query. No user-list API to paginate through, no webhook mirror to keep in sync.
Per-project isolation, keyed by project_id. A user in one project can never reach another. Auth tables are never exposed to the browser; access goes through the auth API.
Sessions are a short JWT plus a rotating refresh token, revocable individually or all at once from the dashboard.

psql

-- auth_users lives in YOUR project's Postgres.
-- Join it with your own tables in plain SQL:
SELECT u.email, count(o.id) AS orders
FROM   auth_users u
JOIN   orders o ON o.user_id = u.id
WHERE  u.status = 'active'
GROUP  BY u.email
ORDER  BY orders DESC;

Supabase parity without the lock-in: your identity data sits in your database, not a vendor’s.

The SDK

One backend SDK: @primdb/auth-node

Point it at your project id and call sign-in. The same client covers email + password, magic link, passkey, sessions, and server-side request validation.

auth.ts

import { createPrimDBAuth } from '@primdb/auth-node'

export const auth = createPrimDBAuth({
  projectId: process.env.PRIMDB_PROJECT_ID,
})

// One API for email + password, magic link, or passkey:
const { user, session } = await auth.signIn.emailPassword({
  email: 'ada@example.com',
  password: '••••••••',
})

// Validate a request on your server. No DB call for a valid JWT:
const current = await auth.validateRequest(request)

The MVP SDK is the backend package @primdb/auth-node. Drop-in React components and a hosted login widget are on the Phase 2 roadmap, not shipped yet.

How it compares

Not another auth vendor to price out

Clerk and Auth0 meter by monthly active user and gate SSO behind an enterprise tier. Supabase Auth keeps your users in their platform. PrimDB Auth does neither.

	PrimDB Auth	Clerk	Auth0	Supabase Auth
No per-MAU pricing				Tiered
No per-MAU SSO tax (flat add-on)	Flat add-on			Add-on
Users in your own Postgres
EU-hosted (not US, not Vercel)
Already wired to your app + DB				Same stack
OAuth social (Google, GitHub)
Signed auth event webhooks + audit log
Two-factor (TOTP) + recovery codes
Organizations & teams (roles + invites)			Enterprise
App SSO / SAML for your end users	Flat add-on	Enterprise	Enterprise

Auth is bundled into the flat $20 platform. No per-MAU cliff at launch. Enterprise SAML sign-in for your own end users is a flat add-on, not a per-seat enterprise tier. A fair-use ceiling comes later as a flat pack, never a per-user meter.

Roadmap

Coming next

Planned, not shipped. We would rather ship a small honest MVP than claim a feature that is not there yet.

React components and a hosted login widget
Python and Go backend SDKs

Shipping today: email + password, magic link, passkeys, OAuth social (Google, GitHub), two-factor (authenticator-app TOTP) with recovery codes, organizations & teams with roles + invitations, and app-level SSO / SAML for your end users (a flat add-on). Everything above is on the roadmap.

Auth questions

Where do my users’ records live?: In your project’s own provisioned Postgres, in the auth_users, auth_sessions, and auth_passkeys tables. You have full SQL access to them and can join them with your application tables. They are never exposed directly to the browser.
Is there a per-MAU or per-seat charge?: No. Auth is bundled into the flat $20 platform with no per-monthly-active-user meter and no SSO tax at MVP. A fair-use ceiling arrives later as a flat pack, never a per-user cliff.
Which sign-in methods work today?: Email + password, magic link over Resend, passkey / WebAuthn, OAuth social (Google, GitHub), two-factor (authenticator-app TOTP) with recovery codes, organizations & teams (roles + email invitations), and app-level SSO / SAML for your end users (a flat add-on) all ship today.
How do I integrate it?: With the @primdb/auth-node backend SDK: create the client with your project id, then call sign-in and validateRequest. React components and a hosted widget are Phase 2, so the MVP integration is server-side.
Where is it hosted?: In the EU, on Hetzner, with per-project isolation. Not the US, not Vercel. It is already next to the app and database you deploy on PrimDB.

Give your app auth that stays yours.

Email, magic link, and passkeys, with your users in your own Postgres. Bundled into the flat $20, free to start.

Start free See pricing