ianstormtaylor/permit

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1681 stars · 54 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Permit is an unopinionated authentication library for Node.js APIs, supporting bearer token and username/password schemes. It works with any server framework such as Express, Koa, Hapi, or Fastify, and any API style including REST and GraphQL.

Use cases

• add bearer token authentication to a Node.js API
• authenticate requests in a Koa or Fastify server without Passport
• check access_token query parameters or auth headers in REST endpoints
• implement basic username/password auth for a GraphQL API
• replace Passport.js with a lighter framework-agnostic auth layer

When to choose

• you need simple API authentication decoupled from any specific framework
• you use Koa, Hapi, or Fastify where Passport is awkward to integrate
• you want full control over your own authentication logic and user storage

When to avoid

• you need social login flows like Facebook, Twitter, or GitHub OAuth out of the box
• you want a batteries-included session-based web app auth solution
• you need a library with frequent releases and active maintenance

Facets

library · maturity maintenance

auth middleware http-server backend apis security web-development authentication bearer-token basic-auth unopinionated express koa hapi fastify rest graphql nodejs

Member repositories

For agents

markdown · JSON · MCP: product_card(name="ianstormtaylor/permit")