Pre-release Launching early 2027 · See what’s available today

Authentication
you mount,
not maintain.

Voult is a hosted auth API for Node.js. Sign-up, login, sessions, OAuth, MFA and passkeys run on Voult. Your Express app mounts one router and gets back to its own features.

Read the docs How it works

acmeacme-web Active

Preview · sample data

Overview

Created Sep 2, 2026 · Cookie sessions

Users1,284total registrations

Logins9,730all time

Sign-in methods6enabled

Recent activity

LOGIN_SUCCESSada@example.com14:22
SESSION_CREATEDada@example.com14:22
TOKEN_REVOKEDlin@example.com14:18
PASSWORD_RESETkofi@example.com14:09
ACCOUNT_LOCKEDpriya@example.com14:02

Enabled methods

Email + password
Magic links
Passkeys
Google
GitHub
Microsoft

Users

Search by email or username

User	Method	Verified	MFA	Last login	Status
Ada Okaforada@example.com	Password	Yes	TOTP	2 min ago	Active
Sam Riverasam@example.com	Google	Yes	Off	14 min ago	Active
Mei Tanakamei@example.com	Passkey	Yes	TOTP	1 h ago	Active
Kofi Mensahkofi@example.com	Magic link	Yes	Off	3 h ago	Active
Lin Chenlin@example.com	GitHub	Yes	TOTP	Yesterday	Active
Priya Nairpriya@example.com	Password	Yes	Off	2 d ago	Locked
Jonas Weberjonas@example.com	Password	No	Off	Never	Unverified

Sessions

Refresh tokens rotate on every use.

User	Device	IP address	Last used	Expires	Actions
ada@example.com	Chrome · macOS	203.0.113.24	2 min ago	in 7 days	Revoke
sam@example.com	Safari · iOS	203.0.113.61	14 min ago	in 7 days	Revoke
mei@example.com	Firefox · Linux	192.0.2.14	1 h ago	in 6 days	Revoke
kofi@example.com	Edge · Windows	198.51.100.33	3 h ago	in 6 days	Revoke
lin@example.com	Chrome · Android	198.51.100.7	Revoked	Reuse detected

Security

Policies and audit trail for this app.

Account lockout5 failed attempts

Multi-factor authTOTP + backup codes

Access tokens15 min lifetime

IP allowlistAlert on new IPs

Time	Event	User	Risk
14:22	`LOGIN_SUCCESS`	ada@example.com	low
14:22	`SESSION_CREATED`	ada@example.com	low
14:18	`TOKEN_REVOKED`Refresh token reuse detected, all sessions revoked	lin@example.com	critical
14:09	`PASSWORD_RESET`	kofi@example.com	high
14:02	`ACCOUNT_LOCKED`5 failed password attempts	priya@example.com	medium

API keys

Server-side only. Never ship these to the browser.

Client ID: app_7f3c9e21b4d8a6
Client secret: Stored hashed. Shown once when created or rotated.Rotate secret
Callback URLs: https://acme.example/auth/callbackhttp://localhost:5173/magic-callback

# .env written by `npx voult init`
VOULT_CLIENT_ID=app_7f3c9e21b4d8a6
VOULT_CLIENT_SECRET=••••••••••••••••
VOULT_SESSION_SECRET=(generated, 32 bytes)

Every field above maps to Voult’s data model. The values are sample data, and some of these views are still being built.

01Why Voult

Login is the smallest feature with the largest attack surface.

A sign-in form needs password hashing, token signing, refresh rotation, lockout, email flows, an OAuth callback per provider and an audit trail. Each piece is security-critical, and none of it is your product.

Built in-house18 modules to write, test and patch

auth/password-hash.js
auth/login.js
auth/lockout.js
auth/tokens/access-jwt.js
auth/tokens/refresh-rotation.js
auth/sessions/revoke.js
auth/email/verify.js
auth/email/reset-password.js
auth/magic-link.js
auth/oauth/google.js
auth/oauth/github.js
auth/oauth/…4 more providers
auth/mfa/totp.js
auth/mfa/backup-codes.js
auth/passkeys/webauthn.js
auth/audit-log.js
middleware/rate-limit.js
middleware/csrf.js

With Voult1 router

app.use('/api/auth',
  createVoultRouter());

The same flows, served by Voult. Security fixes ship in the API, not in your codebase.

02How it works

Your users talk to your server. Your server talks to Voult.

@voult/express runs inside your app and holds the client secret. The browser only ever sees httpOnly cookies. Here is a password login, end to end.

1 Browser → Your server POST /api/auth/email-login email + password
2 Your server → Voult API Authenticated with your client ID + secret the secret never reaches the browser
3 Voult API Checks lockout, verifies the bcrypt hash, issues an MFA challenge if enabled, writes an audit event
4 Voult API → Your server Access token + refresh token short-lived JWT, rotating refresh token
5 Your server → Browser Set-Cookie: httpOnly refreshed via /sessions/refresh

03What’s included

What Voult handles today, and what’s still coming.

Available In progress Planned

Sign-in methods

Every method lands in the same user record and the same session model.

Email + passwordbcrypt-hashed, strength rules enforced
Available
Username + passwordregister and log in by username
Available
OAuthGoogle, GitHub, Microsoft, Apple, Facebook, LinkedIn
Available
Magic linkssingle-use, allowlisted redirect URIs
Available
PasskeysWebAuthn registration and sign-in
Available
Email verificationunverified accounts can’t log in
Available
Password resetforgot / reset flow with emails sent by Voult
Available
Account linkingconnect several providers to one user
Available

Sessions & security

Secure defaults that are on for every app, not settings you have to find.

Access tokensshort-lived JWTs with token versioning
Available
Refresh rotationreplaying an old token revokes every session
Available
Session managementlist and revoke sessions per user
Available
MFATOTP with backup codes and attempt limits
Available
Account lockoutafter 5 failed password attempts
Available
Rate limitingRedis-backed limits on sensitive endpoints
Available
CSRF + headersCSRF tokens and Helmet security headers
Available
IP allowlistsper app, with alerts for new IPs
Available
Audit logevery auth event, tagged with a risk level
Available

Refresh-token rotation

rt_Art_Brt_C each refresh returns a new token and retires the old one

rt_A401 a retired token is replayed: every session for that user is revoked, audit risk CRITICAL

Developer tooling

Published packages today; the rest is marked as in progress or planned.

@voult/sdkJavaScript client for Node and the browser
Available
@voult/expressmountable auth router, cookie or bearer sessions
Available
@voult/clivoult init writes .env and a session secret
Available
Developer dashboardapps, credentials, secret rotation, OAuth config
Available
Documentationquick start and API reference
In progress
Playgroundtry every flow against a real app
In progress
@voult/reacthooks and pre-built sign-in components
Planned
voult doctorchecks your integration end to end
Planned

04Integration

What using Voult looks like.

No auth routes to write. Mount the router, and your frontend calls your own /api/auth endpoints.

1
Create an app
The dashboard gives you a client ID and a secret, shown once.
2
Install and run npx voult init
Writes .env (mode 0600) and .env.example, and generates your session secret.
```
npm install express @voult/express @voult/sdk
```
3
Mount the router
Your app now serves these routes:

POST/register POST/email-login POST/username-login POST/sessions/refresh GET/user/me POST/user/forgot-password GET/user/verify-email POST/mfa/verify POST/logout

Works with Express 4 or 5 and the Next.js App Router (14.2+), on Node.js 20.12+. Any frontend that can call fetch works too; the Voult playground is built with React and Vite.

JavaScript

import express from 'express';
import { createVoultRouter } from '@voult/express';

const app = express();

// Reads VOULT_CLIENT_ID, VOULT_CLIENT_SECRET and
// VOULT_SESSION_SECRET from the .env written by `voult init`.
app.use('/api/auth', createVoultRouter());

app.listen(3000);

JavaScript

// Cookie strategy: tokens live in httpOnly cookies, never in JS.
await fetch('/api/auth/email-login', {
  method: 'POST',
  credentials: 'include',
  headers: { 'Content-Type': 'application/json' },
  body: JSON.stringify({ email, password }),
});

const me = await fetch('/api/auth/user/me', { credentials: 'include' });

JavaScript

import voult from '@voult/sdk';

const auth = voult({
  clientId: process.env.VOULT_CLIENT_ID,
  clientSecret: process.env.VOULT_CLIENT_SECRET,
});

const result = await auth.signInWithEmailAndPassword(email, password);

if (result.mfaRequired) {
  await auth.verifyMfaLogin(result.mfaPendingToken, code);
}

Real @voult/express and @voult/sdk APIs, as published on npm.

05Pricing

Pricing is published before launch.

We won’t list plans until they’re final. Questions about pricing or volume can come to us directly.

Availability: Not open for sign-ups yet. Launch is planned for early 2027; no exact date yet.
Included: The full auth API, the @voult/* npm packages, the dashboard and audit log
Plans: Published before public launch

Stop maintaining login code.

Voult is in active development and launching early 2027. The packages are on npm, and we’re happy to talk.

@voult/express @voult/next @voult/react @voult/cli Docs

Authentication
you mount,
not maintain.

Overview

Recent activity

Enabled methods

Users

Sessions

Sign-in methods

Passwords & passwordless

OAuth providers

Security

API keys

Login is the smallest feature with the largest attack surface.

Your users talk to your server. Your server talks to Voult.

What Voult handles today, and what’s still coming.

Sign-in methods

Sessions & security

Developer tooling

What using Voult looks like.

Pricing is published before launch.

Stop maintaining login code.

Authentication you mount, not maintain.

Recent activity

Enabled methods

Passwords & passwordless

OAuth providers

Login is the smallest feature with the largest attack surface.

Your users talk to your server. Your server talks to Voult.

What Voult handles today, and what’s still coming.

Sign-in methods

Sessions & security

Developer tooling

What using Voult looks like.

Pricing is published before launch.

Stop maintaining login code.

Authentication
you mount,
not maintain.