Auth

Zero-dependency authentication, user management, and notification system for SvelteKit. JWT sessions, WebAuthn passkeys, push notifications, and pre-built UI — all powered by Web Crypto API.

@urbicon-ui/auth provides everything you need for auth in a SvelteKit app: session management, registration with invitation gates, password reset flows, passkey login, real-time notifications, and push — with zero runtime dependencies.

All UI components use @urbicon-ui/blocks primitives, support unstyled / slotClasses / snippet overrides, and auto-detect locale from the @urbicon-ui/i18n context.

Architecture

Each auth flow has two sides: a UI component (client) and a handler factory (server). The UI components send fetch requests to your SvelteKit API routes. The handler factories create those endpoints with all security built in.

UI Component	Server Handler	Default Endpoint	What it does
LoginPage	createLoginHandler	/api/auth/login	PBKDF2 verify, lockout, JWT session
RegisterPage	createRegisterHandler	/api/auth/register	Invitation check, hash, verify email
ForgotPasswordPage	createForgotPasswordHandler	/api/auth/forgot-password	Token email, timing-safe
ResetPasswordPage	createResetPasswordHandler	/api/auth/reset-password	Token verify, re-hash
VerifyEmailPage	createVerifyEmailHandler	/api/auth/verify-email	SHA-256 token check
PasskeyManager	createPasskey*Handler	/api/auth/passkey/*	WebAuthn CBOR/COSE verify
InvitationManager	createInvitationHandlers	/api/invitations	authorize-gated CRUD
NotificationListener	createStreamHandler	/api/notifications/stream	SSE with keep-alive

All server handlers are imported from @urbicon-ui/auth/server. Database access is abstracted via the Adapter pattern — a Prisma adapter is included, custom adapters implement the repository interfaces.