Auth Starter Kit
Auth Starter Kit is a Next.js 14 project that already has the account pages an application needs. I made it to start my own projects from, so that sign-up, sign-in and password reset are written once.
What it covers
- Sign-up with an email address and a password
- A six-character code sent by email to confirm the address
- Sign-in with Google or GitHub
- A password reset link sent by email
- A dashboard page that only a signed-in user can open
How accounts are protected
Passwords are hashed with Argon2id before they reach the database. A password needs at least eight characters, with a letter, a digit and a symbol.
Sessions are handled by Lucia and stored in PostgreSQL through Prisma. The browser only holds a session cookie, and signing out invalidates the session on the server.
The confirmation code and the reset link both expire after ten minutes, and a new email can only be requested once a minute. For a reset, the server keeps a SHA-256 hash of the token and never the token itself.
const resetToken = crypto.randomBytes(32).toString('hex');
const tokenHash = createHashFromToken(resetToken);Sign-in gives the same error for an unknown address and for a wrong password. The Google and GitHub flows check the state value on return, and the Google flow adds a PKCE code verifier.
Data model
| Table | What it holds |
|---|---|
User |
Name, email address, password hash, avatar |
Session |
The sessions Lucia opens for a user |
EmailVerification |
The confirmation code and its expiry |
PasswordReset |
The hash of the reset token and its expiry |
OAuthAccount |
The link between a user and a Google or GitHub account |
How it is built
The pages use the Next.js App Router. Forms call server actions, and every input is checked against a Zod schema. Emails are sent with Resend, and the interface is built with Tailwind CSS and shadcn/ui.