Guards know your user type. Gates fail closed.

Token and session guards typed to your user model, gates and policies that deny what they do not know, and the account flows most applications rebuild — as add-ins.

Read the Authentication docs

curl transcript: wrong password and unknown email get the same message, an anonymous /api/me is refused, a bearer token is accepted.

What you get

AuthManager<User> with TokenGuard and SessionGuard; Argon2 hashing, and bcrypt $2y$ for imported users.
Sessions in memory, the database, the cache or a cookie, with CSRF protection.
Gates and policies; an undefined ability is denied.
Add-ins: accounts (registration, login with lockout, reset, verification), two-factor (TOTP), passkeys (WebAuthn), impersonation.
sso: GitHub, Google, Microsoft, GitLab, Discord, X, and any OpenID Connect provider.
oauth-server: authorization code with PKCE, refresh tokens, client credentials, personal access tokens, scopes.
Captcha: Turnstile, hCaptcha, reCAPTCHA. No SAML.

In the docs

src/bootstrap.rs

let auth = AuthManager::<User>::new("api")
    .register(Arc::new(TokenGuard::new("api", Arc::clone(&provider))))
    .register(Arc::new(SessionGuard::new("web", provider, sessions)));
app.instance(Arc::new(auth));

// src/app/policies/post_policy.rs — a gate that fails closed.
pub fn gate() -> Gate<User> {
    Gate::new()
        .define("posts.publish", |user: &User, post: Option<&Post>| {
            post.is_some_and(|post| post.belongs_to(user.id))
        })
        .define_simple("posts.create", |_user: &User| true)
}

// In the controller: a denial is a 403, an undefined ability is a denial.
PostPolicy::gate().authorize("posts.publish", author.get(), Some(&post))?;

Up close

Select an image to see it full size.

accounts example output: register, verify, log in, password reset and a reset link that only works once. — The accounts add-in end to end: registration, email verification gating the dashboard, login, and a password reset link that cannot be used twice.

two_factor example output: TOTP secret and code, a replayed code refused, recovery codes spent once. — TOTP accepts a code once per time step and recovery codes once each; a replay is refused.

oauth_server example output: authorization code with PKCE, refresh, client credentials, personal access tokens and scope checks. — The OAuth server refuses a reused code and an old refresh token, and a token without the vehicles scope gets a 403.

impersonation example output: an admin viewing as a customer, billing blocked while impersonating, audit lines. — Impersonation is audited and fenced: billing is off-limits while viewing as someone else, and a customer cannot impersonate an admin.

All features