anahtar: incredibly simple & secure auth with passkeys and email+otp fallback

Pre-alpha. API may change between releases.

Auth for SvelteKit. Email+OTP + optional passkeys.

"Anahtar" = key (Turkish)

Auth flow

1. Email -> OTP sent via your onSendOTP callback
2. OTP verified -> session cookie
3. First login -> passkey registration prompt
4. Future logins -> passkey autofill, OTP fallback

Roadmap: Proof-of-concept: everything can change

The goal is simplicity, we will likely stay with passkeys and email+OTP only.

• we may change the implementation.
• headless use: @mrgnw/anahtar/client wraps every route (OTP, sessions, passkey ceremonies); the components are built on it.

Quick start

pnpm add @mrgnw/anahtar

Create your auth instance:

// src/lib/server/auth.ts
import { createAuth } from "@mrgnw/anahtar";
import { sqliteAdapter } from "@mrgnw/anahtar/sqlite";
import Database from "better-sqlite3";

const db = new Database("data/app.db");

export const auth = createAuth({
  db: sqliteAdapter(db),
  onSendOTP: async (email, code) => {
    console.log(`[dev] OTP for ${email}: ${code}`);
  },
});

Wire into SvelteKit:

// src/hooks.server.ts
import { auth } from "$lib/server/auth";
export const handle = auth.handle;

// src/routes/api/auth/[...path]/+server.ts   (the param must be named `path`)
import { auth } from "$lib/server/auth";
export const { GET, POST } = auth.handlers;

// src/app.d.ts
import type { AuthLocals } from "@mrgnw/anahtar";
declare global {
  namespace App {
    interface Locals extends AuthLocals {} // locals.user, locals.session
  }
}
export {};

Optional UI components:

<!-- Full-page auth flow -->
<script>
  import { AuthFlow } from '@mrgnw/anahtar/components';
  import { goto } from '$app/navigation';
</script>

<AuthFlow onSuccess={() => goto('/')} />

<!-- Compact inline pill (for headers, floating islands) -->
<script>
  import { AuthPill } from '@mrgnw/anahtar/components';
  import { invalidateAll } from '$app/navigation';
  import { page } from '$app/state';
  let user = $derived(page.data.user);
  let session = $derived(page.data.session);
</script>

<AuthPill {user} {session} onSuccess={() => invalidateAll()} onSignOut={() => invalidateAll()} />

Pass session (locals.session) and the pill offers a one-tap "Stay signed in" passkey renewal near expiry. The chip is also exported on its own as SessionRenew for apps with their own signed-in header.

All components auto-detect locale (88 languages). Override with locale="fr" or messages={{ continue: 'Go' }}.

Tests

109 tests: 83 unit (node) + 26 component (happy-dom).

pnpm test:unit
pnpm test:browser
pnpm test

Docs

• Integration guide — install, config, components, i18n, theming, DB adapters
• Security notes — rate limiting you must add, passkey and session defaults
• PLAN.md — architecture, DB adapter interface, test setup