Auth Pwless

About

A self-hosted passwordless auth plugin for Payload CMS 3.x. It replaces the built-in email-and-password strategy on the `users` collection with WebAuthn/passkey login, magic-link email login, and OAuth social login (Google and Facebook). A custom session system issues short-lived JWT access tokens plus long-lived refresh tokens stored in HttpOnly cookies, with device-fingerprint binding and deduplication of concurrent requests. The plugin extends an existing `auth: true` users collection and registers two new collections for WebAuthn credentials and sessions. It injects its own authentication strategy into the Payload config and adds the API endpoints for each flow: registration and verification ceremonies for passkeys, magic-link request and consume, OAuth callback handlers with verified-email-only account linking by email, token refresh, logout, and an optional onboarding step. Configuration is optional with sensible defaults. You can toggle each method independently (`enableWebAuthn`, `enableMagicLink`, `enableOAuth`), set session and token lifetimes, define allowed WebAuthn origins for multi-host setups, and enable optional application contexts that run one Payload instance behind multiple frontends with different session lifetimes and email branding. Expired sessions are cleaned up by a scheduled Payload Jobs Queue task, which requires `jobs.autoRun` or an external cron runner to execute. Admin panel login components are injected automatically and can be disabled. Authorization is intentionally out of scope. The plugin handles identity and sessions; bring your own roles and permissions layer on top. Note that adding the plugin sets `disableLocalStrategy: true`, so existing email-and-password logins on the extended users collection stop working and need a migration path.

Package info

Package name

@trieb.work/payload-auth-pwless

Latest version

0.2.0

Unpacked size

564 kB

License

MIT

Weekly downloads

5

Last publish

Jul 29, 2026