auth-verify: JWT, OTP, Passkeys and More in One Node.js Library

Authentication should be boring. In practice, though, you end up writing a lot of repetitive glue code: generating OTPs, sending emails and SMS, storing tokens, signing JWTs, setting cookies, and verifying tokens on every incoming request.

auth-verify is a Node.js library that wraps all of that into one modular package, so you can spend your time on your actual product.

What is auth-verify?

auth-verify is a modular authentication library for Node.js. It provides:

• JWT helpers (sign, verify, decode, revoke)
• Secure cookies handled for you
• OTP (one-time passwords) via email, SMS, and Telegram bot
• TOTP codes and QR code generation
• Passkeys (WebAuthn) for passwordless login
• Magic links for passwordless login
• Session management
• OAuth helpers
• Crypto hashing with algorithms like pbkdf2 and scrypt
• A REST API for generating, sending, and verifying OTPs
• Custom senders, so you can plug in your own way of delivering OTPs or notifications

It's published under the MIT license.

Installation

npm install auth-verify

Quick start

const AuthVerify = require('auth-verify');

const auth = new AuthVerify({
  jwtSecret: 'super_secret_key',
  cookieName: 'auth_token',
  storeTokens: 'redis',           // or 'memory'
  redisUrl: 'redis://localhost:6379',
});

That's the whole setup. Tokens can be stored in Redis for production or in memory for quick development.

JWT with cookies, in one line

Signing a token and setting it as an httpOnly cookie happens in a single call:

// Sign a JWT and set it automatically as an httpOnly cookie
const token = await auth.jwt.sign({ userId: 1 }, '1h', { res });

And verifying is just as short. You can pass a token string, or the whole request and let the library find the token for you:

// 1. Verify a token string
const decoded = await auth.jwt.verify(token);

// 2. Verify directly from a request
const decoded = await auth.jwt.verify(req);

When you pass the request, the token is read from the Authorization header (Bearer <token>) or from the cookie (auth_token by default). verify returns the decoded payload if the token is valid, and throws an error if it is invalid or revoked.

Here's the core JWT API at a glance:

A minimal login system

{% raw %}

const express = require('express');
const AuthVerify = require('auth-verify');

const app = express();

const auth = new AuthVerify({
  jwtSecret: 'supersecret',
  storeTokens: 'memory',
});

app.post('/login', async (req, res) => {
  const token = await auth.jwt.sign({ userId: 1 }, '1h', { res });
  res.json({ success: true, token });
});

app.get('/me', async (req, res) => {
  const user = await auth.jwt.verify(req);
  res.json({ user });
});

app.listen(3000);

No extra middleware and no manual res.cookie() calls. In a real app you would of course check the user's credentials before signing a token.

Why you might like it

• Less boilerplate. JWT, cookies, and a token store work together out of the box.
• Flexible token storage. Switch between Redis and memory with one option.
• Passwordless options. Passkeys (WebAuthn) and magic links are part of the same library.
• Multiple OTP channels. Email, SMS, and Telegram, plus custom senders if you need something else.
• Works with your stack. Use it with Express, Fastify, or a custom HTTP server.

A few tips

• Keep your jwtSecret in an environment variable, never in your source code.
• Use storeTokens: 'redis' in production. In-memory tokens disappear when the server restarts.
• Always use HTTPS so your cookies and tokens are protected in transit.

Wrapping up

If you are tired of wiring together a JWT library, a cookie parser, an OTP generator, and a token store by hand, auth-verify gives you all of them behind one consistent API.

Give it a try:

npm install auth-verify

You can find the package on npm. I'd love to hear what you think, and which authentication feature you would want to see next. Let me know in the comments!