AuthKit-Litev2.0.0
AuthKit overview
Run AuthKit-Lite with local defaults, explore its authentication APIs, and understand its security model.
Updated
Included in AuthKit-Lite
- Password registration and BCrypt verification
- Short-lived JWT access tokens
- Opaque refresh tokens hashed at rest and rotated under a database lock
- Role-based authorization
- Optional WebAuthn passkey registration and authentication
- Flyway-managed H2 and MySQL schemas
- Browser API test console, Postman collection, and integration tests
Run and try it first
AuthKit-Lite runs without a .env file or external database. The default H2 database, generated local JWT secret, and demo users are enough to start the application and explore the available APIs at http://localhost:8080/api-test.
Runtime boundary
The /api/** security chain is stateless and authenticates Bearer JWTs. WebAuthn uses a separate ordered filter chain with temporary HTTP-session ceremony state and cookie-backed CSRF protection.
What remains application-specific
- Domain authorization and ownership rules
- Production secret management
- HTTPS and edge rate limiting
- Monitoring and audit retention
- Account recovery and broader identity workflows