Product preview
AuthKit Lite login
Release details
View changelog- Version
- v2.0.0
- Java
- 25 LTS
- Spring Boot
- 4.1.1
- License
- MIT License
Capability summary
Features
The focused capabilities included in the current product generation.
JWT + refresh tokens
Short-lived JWT access tokens pair with opaque, hashed refresh tokens that rotate on use.
WebAuthn passkeys
Optional passkey registration and authentication use Spring Security's native WebAuthn support.
Role-based authorization
Protect application APIs with explicit Spring Security authorities and method rules.
Local development defaults
Start with H2, Flyway migrations, and optional demo users before switching to MySQL.
Testing tools included
Use the same-origin browser console, Postman workflow, and automated integration suite.
AI-ready project context
Architecture and contribution rules make important boundaries discoverable to developers and coding agents.
Fit
Who this is for
- Spring Boot APIs that need reusable authentication
- SaaS products supporting password and passkey sign-in
- Admin dashboards with role-based access
- Internal tools that need a clear security boundary
Build or adopt
Why AuthKit-Lite?
AuthKit-Lite removes repeated authentication infrastructure while keeping application-specific authorization decisions visible.
Without AuthKit-Lite
- Design access and refresh-token lifecycles
- Wire Spring Security and role mapping
- Implement WebAuthn ceremony state and persistence
- Prepare migrations, tests, and local infrastructure
With AuthKit-Lite
- JWT and refresh-token flows are ready to adapt
- Passkeys use Spring Security's native WebAuthn support
- RBAC and protected user APIs are included
- H2 and Flyway provide a dependency-free first run
Implementation resources
Technical documentation
Task-oriented setup, configuration, architecture, and API references for this product.
Clone and run AuthKit-Lite without local configuration, then try every available API in your browser.
DocumentationConfigurationUnderstand AuthKit-Lite runnable defaults and add .env overrides for further development or deployment.
DocumentationAPI ReferenceTry AuthKit-Lite APIs in the browser and reference authentication, passkey, user, and operations endpoints.
DocumentationArchitectureUnderstand AuthKit-Lite authentication, security, persistence, migrations, and test boundaries.
Related guidance
Related guides
Architecture and implementation guidance related to this foundation.
Implement JWT authentication and role-based authorization with Spring Security, password hashing, protected REST APIs, and explicit security boundaries.
GuideSpring Boot JWT Authentication ArchitectureStructure Spring Boot JWT authentication across security configuration, token validation, user lookup, authorization, persistence, and application services.
GuideJWT Authentication Mistakes in Spring BootReview common Spring Boot JWT mistakes involving token lifetime, refresh tokens, secrets, authorization, filter boundaries, and security configuration.
Evaluate AuthKit-Lite
Run the local defaults, review the authentication boundary, and adapt the application-specific authorization rules to your product.