Introducing PrimDB Auth — authentication that lives in your own database

Every app needs a sign-in, and almost every team solves it by renting one. You bolt on a vendor, and from then on your users live somewhere you cannot query. Answering “which of my paying customers signed in this week” means a user-list API to paginate, a webhook mirror to keep in sync, and a bill that climbs with every monthly active user. PrimDB Auth is the fifth product pillar, and it takes the opposite bet: your users belong in your database.

Your users in your own Postgres

When you turn Auth on for a project, PrimDB creates three tables in that project’s own provisioned Postgres: auth_users, auth_sessions, and auth_passkeys. Not a copy, not a mirror. The real records live in the same database your app already talks to, so you can join them with your own tables in one query.

-- auth_users lives in YOUR project's Postgres.
-- Join it with your own tables in plain SQL:
SELECT u.email, count(o.id) AS orders
FROM   auth_users u
JOIN   orders o ON o.user_id = u.id
WHERE  u.status = 'active'
GROUP  BY u.email
ORDER  BY orders DESC;

This is the Supabase-parity idea without the lock-in: your identity data is in your database, not a vendor’s. There is no export job to get your own users back, because they never left. Per-project isolation keyed by project_id means a user in one project can never reach another, and the auth tables are never exposed to the browser — access goes through the auth API.

Three ways in, shipping today

The MVP ships three sign-in methods, each toggled per project from the dashboard:

• Email + password: passwords hashed with bcrypt, lockout after repeated failures, and password reset over a single-use link.
• Magic link: a one-time sign-in link sent over Resend, single-use and rate-limited, so it expires fast and cannot be replayed once clicked.
• Passkey (WebAuthn): sign in with Touch ID, Face ID, or a security key bound to your domain, with magic link as the fallback.

Sessions are a short JWT plus a rotating refresh token, revocable individually or all at once from the dashboard. A valid access token validates without a database round-trip.

One backend SDK: @primdb/auth-node

Integration is a backend package, now on npm: npm i @primdb/auth-node. Point it at your project id and call sign-in. The same client covers email + password, magic link, passkey, sessions, and server-side request validation.

import { createPrimDBAuth } from '@primdb/auth-node'

export const auth = createPrimDBAuth({
  projectId: process.env.PRIMDB_PROJECT_ID,
})

// Email + password, magic link, or passkey — one API:
const { user, session } = await auth.signIn.emailPassword({
  email: 'ada@example.com',
  password: '••••••••',
})

// Validate a request on your server. No DB call for a valid JWT:
const current = await auth.validateRequest(request)

That is the whole integration surface at MVP: it is server-side. Drop-in React components and a hosted login widget are on the roadmap, not shipped yet.

Why this beats bolting on a vendor

Clerk and Auth0 meter by monthly active user and gate SSO behind an enterprise tier. Supabase Auth keeps your users in their platform. PrimDB Auth does neither: it is bundled into the flat $20 platform, with no per-MAU meter and no SSO tax at launch, hosted in the EU on Hetzner rather than the US. A fair-use ceiling comes later as a flat pack, never a per-user cliff. And it is already wired to the app and database you deploy here, so there is no fourth vendor to price out and keep in sync.

What’s next

We would rather ship a small honest MVP than claim a feature that is not there. So, to be clear about what is not shipped yet, these are on the Phase 2 roadmap:

• OAuth social sign-in (Google, GitHub, and more).
• App SSO / SAML for your end users, as a paid add-on.
• MFA / TOTP with an authenticator app.
• Organizations and teams inside your app.
• React components and a hosted login widget.

Honest note. Shipping today: email + password, magic link, and passkeys, with your users in your own Postgres. Everything in the list above is planned, not live.

Read the full story on the Auth page, or turn it on for a project from the dashboard.