Introduction
Radon is self-hosted authentication for Node.js — email codes, magic links, passwords, and OAuth over any database, wired into your framework in a few lines.
Radon is an open-source authentication library for Node.js. It runs entirely inside your own backend — your database, your email provider, your servers. There's no hosted service to sign up for, no per–monthly-active-user pricing, and no vendor to migrate away from later.
You install one package, give it an adapter (where users are stored) and a sender (how emails go out), turn on the providers you want, and mount it into your framework. That's the whole model.
import { Radon } from "@radonsdk/auth";
import { postgresAdapter } from "@radonsdk/auth/adapters/postgres";
import { resendSender } from "@radonsdk/auth/senders/resend";
import { Pool } from "pg";
const pool = new Pool({ connectionString: process.env.DATABASE_URL });
const sender = resendSender({ apiKey: process.env.RESEND_API_KEY!, from: "Acme <auth@acme.com>" });
export const auth = new Radon({
adapter: postgresAdapter(pool),
session: { secret: process.env.RADON_SECRET! },
providers: {
emailCode: { sender },
},
});New here? The fastest path to a working sign-in flow is the Quickstart — about five minutes, start to finish.
What you get
Own your data
Users, sessions, and codes live in your database. Radon never phones home.
No lock-in
Swap Postgres for Mongo, or Resend for SES, without touching your auth code.
Framework-native
One-line mounts for Next.js, Express, Fastify, and Hono.
Batteries included
Email codes, magic links, passwords, Google — plus 50 OAuth providers, passkeys, 2FA, and SMS in Pro.
The three pieces you configure
Radon has exactly three moving parts. Once you understand them, the whole library falls into place — they're covered in depth in Core concepts.
- Adapter — the bridge to your database. It's a small contract (create user, find user, store a code…) so any database can back Radon. There are built-in adapters for MongoDB, PostgreSQL, MySQL, SQLite, Prisma, Supabase, and Firebase. Swapping databases never means re-authenticating your users.
- Sender — how transactional email leaves your app (verification codes, magic links, password resets). Point it at Resend, SendGrid, Postmark, or AWS SES — or chain several for failover.
- Providers — the sign-in methods you turn on. Each one you list under
providersbecomes available; everything you leave out stays off (and never ships in your bundle).
Free vs. Pro
Everything in Getting Started, Auth Methods (email code, magic link, password, Google), and Framework Integrations is free and MIT-licensed.
Radon Pro unlocks 50 OAuth providers, phone/SMS OTP, passkeys/WebAuthn, 2FA/TOTP, refresh tokens, multi-device sessions, API keys, orgs/teams, and six more framework integrations. Pro features are clearly marked with a Pro badge throughout these docs. See Radon Pro.