auth-core

What it is

auth-core.

Users, identities, credentials, sessions, single-use tokens, clients and their redirect URIs, plus the flows every login method shares: authorization code with PKCE, ES256 access tokens published through JWKS, and account linking that only ever joins two identities on an email both providers say they verified.

Anything single-use lives in the database, never in KV. KV is eventually consistent, and magic links, WebAuthn challenges, authorization codes and refresh tokens are all things that must be spendable exactly once. They go in single_use_tokens with a kind, consumed by a guarded update whose affected-row count is checked, so two concurrent consumes cannot both win. Nothing that can log somebody in — session cookie values, magic-link tokens, client secrets — is stored in the clear.