Auth that ships
with the framework.
No third-party auth provider, no integration tax. @voltro/plugin-auth brings passwords, sessions, passkeys, MFA and multi-tenant memberships; RBAC compiles roles to scopes; API keys are first-class. Bring your own IdP when you need to — six adapters plus SAML and SCIM stack alongside.
// app.config.ts — API keys are first-class
export default { apiKeys: true /* … */ }
// auth wiring — passwords, sessions, passkeys, MFA
import { authRoutesPlugin } from '@voltro/plugin-auth'
import { permission } from '@voltro/plugin-rbac'
plugins: [authRoutesPlugin()] // mounts /auth/*
// guard a mutation — the Effect-native RBAC scope check
import { EffectStore } from '@voltro/runtime'
import { Effect } from 'effect'
export default (input, ctx) => Effect.gen(function* () {
yield* permission(ctx, 'posts:write') // fails typed Forbidden
const store = yield* EffectStore
return yield* store.insert('posts', input)
})What ships in the auth suite.
Passwords & signed sessions
scrypt hashing with rehash-on-verify, stateless signed-cookie sessions with multi-key rotation and sliding-window renewal, magic links, password reset, CSRF, and session enumeration + revocation.
Passkeys / WebAuthn
First-class passwordless sign-in with atomic clone detection and a bring-your-own multi-replica challenge store. Register once, sign in with a device biometric.
MFA & memberships
TOTP MFA with sign-in enforcement and recovery codes, plus multi-tenant memberships and switch-tenant — a user can belong to several orgs and move between them.
API keys, first-class
Turn on apiKeys in app.config.ts for Bearer-key auth with admin-gated issue / list / revoke and hash-only storage — not a plugin, part of the protocol.
RBAC that compiles to scopes
@voltro/plugin-rbac turns roles into scopes over the protocol’s scope system: permission() / assertPermission() guards, compileRoles(), typed Forbidden errors, and a useCan() hook for the UI.
Enterprise SSO — SAML, SCIM, OIDC
Six IdP adapters (WorkOS, Clerk, Auth0, Kinde, Supabase, generic OIDC) verify JWTs via JWKS and map claims to a tenant. @voltro/plugin-sso-saml adds SAML 2.0; @voltro/plugin-scim adds SCIM 2.0 provisioning.
Strategies stack; the Subject is typed.
One identity model, many front doors
Auth strategies compose — password and an IdP can run side by side, each resolving to the same typed Subject your handlers read. A shared JWT-bearer strategy verifies JWKS and maps claims to a tenant, so adding SSO doesn’t change a single handler. React glue (SubjectProvider, useSubject, RequireAuth) wires the client.
Auth composes with the rest of the runtime.
Open the framework. See it for yourself.
Every primitive on this page is in the framework today. Clone the starter, run `voltro dev`, and have it on screen in two minutes.