Core Systems
Authentication
Enterprise-grade authentication powered by Better Auth. OAuth, SSO, RBAC, and more. Secure by default, flexible when needed.
Overview
Without proper authentication, your API is vulnerable. With MoroJS, you get enterprise-grade security out of the box.
Traditional auth setup requires multiple libraries, complex configuration, and manual security handling. We handle that automatically.
1app.use(auth({
2 providers: [
3 providers.github({
4 clientId: process.env.GITHUB_CLIENT_ID!,
5 clientSecret: process.env.GITHUB_CLIENT_SECRET!,
6 }),
7 ],
8 secret: process.env.AUTH_SECRET,
9}));Without Proper Auth
- Manual session management
- Complex OAuth integration
- Security vulnerabilities
- No built-in RBAC
With MoroJS
- One-line OAuth setup
- Built-in RBAC system
- Secure by default
- Enterprise SSO support
OAuth Ready
GitHub, Google, Discord, Microsoft, LinkedIn, and more. One-line setup.
Enterprise SSO
Okta, Auth0, AWS Cognito integration. Enterprise-ready out of the box.
RBAC Built-in
Role-based access control with permissions. Protect routes easily.
1// Require authentication
2app.get('/profile').use(requireAuth()).handler((req, res) => {
3 return { success: true, data: { user: req.auth.user } };
4});
5
6// Require admin role
7app.get('/admin').use(requireAdmin()).handler((req, res) => {
8 return { success: true, data: { users: getUserList() } };
9});How It Works
MoroJS authentication is powered by Better Auth, providing secure OAuth flows, session management, and role-based access control. The authentication middleware automatically handles OAuth callbacks, session creation, and route protection.
Quick Setup
Set up authentication in three steps:
1# Required
2AUTH_SECRET=your-secret-key-here-32-characters-minimum
3GITHUB_CLIENT_ID=your-github-client-id
4GITHUB_CLIENT_SECRET=your-github-client-secret
5
6# Optional
7AUTH_URL=http://localhost:30001import { createApp, auth, providers } from '@morojs/moro';
2
3const app = await createApp();
4
5// Basic OAuth setup
6app.use(auth({
7 providers: [
8 providers.github({
9 clientId: process.env.GITHUB_CLIENT_ID!,
10 clientSecret: process.env.GITHUB_CLIENT_SECRET!,
11 }),
12 providers.google({
13 clientId: process.env.GOOGLE_CLIENT_ID!,
14 clientSecret: process.env.GOOGLE_CLIENT_SECRET!,
15 }),
16 ],
17 secret: process.env.AUTH_SECRET,
18}));
19
20// Protected route
21app.get('/dashboard', (req, res) => {
22 if (!req.auth.isAuthenticated) {
23 return res.status(401).json({ error: 'Unauthorized' });
24 }
25
26 return {
27 success: true,
28 message: 'Welcome to your dashboard',
29 data: { user: req.auth.user }
30 };
31});1// Check authentication in route handler
2app.get('/dashboard', (req, res) => {
3 if (!req.auth.isAuthenticated) {
4 return res.status(401).json({
5 success: false,
6 error: 'Unauthorized'
7 });
8 }
9
10 return {
11 success: true,
12 data: { user: req.auth.user }
13 };
14});Role-Based Access Control
Protect routes with role-based access control. Use built-in helpers or create custom authorization logic.
1import { requireAuth, requireRole, requireAdmin } from '@morojs/moro';
2
3// Require authentication
4app.get('/profile').use(requireAuth()).handler((req, res) => {
5 return { success: true, data: { user: req.auth.user } };
6});
7
8// Require specific role
9app.get('/admin').use(requireRole(['admin'])).handler((req, res) => {
10 return { success: true, data: { message: 'Admin panel' } };
11});
12
13// Require admin role (shorthand)
14app.get('/admin/users').use(requireAdmin()).handler((req, res) => {
15 return { success: true, data: { users: getUserList() } };
16});Available Helpers
requireAuth()- Require user to be authenticatedrequireRole(['admin'])- Require specific rolerequireAdmin()- Require admin role (shorthand)requireAuth({ authorize })- Custom authorization logic