Radon

Installation

Install Radon, add a database driver and an email provider, and set your environment variables.

Radon ships as a single package. You pick one database driver and one email provider to go with it — both are things you probably already have.

1. Install the package

npm install @radonsdk/auth

That's the core. Adapters, senders, and framework integrations are separate import paths (@radonsdk/auth/adapters/postgres, @radonsdk/auth/senders/resend, @radonsdk/auth/integrations/next, …) so you only pull in what you use.

2. Add a database driver

Radon talks to your database through its driver. Install the one that matches where your users will live:

npm install pg

Already using Prisma, Supabase, or Firebase?

You don't need a separate driver — Radon has adapters that reuse your existing client. See Adapters.

3. Add an email sender

Email senders talk to their API over fetchno SDK to install. Resend is the default and the most common choice:

# No install needed for Resend, SendGrid, or Postmark.
# (Only AWS SES needs a package:)
npm install @aws-sdk/client-sesv2

You'll also need an API key from your email provider. For Resend: create a key at resend.com/api-keys, and verify a domain you own so email actually arrives.

4. Set environment variables

Radon needs a signing secret, your database connection string, and your email key. Add them to .env:

.env
# 32+ hex chars — signs JWT sessions and magic-link/reset tokens.
RADON_SECRET=$(openssl rand -hex 32)

# Your database connection string.
DATABASE_URL="postgres://user:pass@localhost:5432/app"

# Your email provider's API key (Resend shown here).
RESEND_API_KEY="re_xxxxxxxxx"

Keep RADON_SECRET secret

RADON_SECRET signs every session token and every magic-link / reset token. If it leaks, anyone can forge logins. Never commit it. Rotating it invalidates all existing sessions and links — everyone is logged out once, and users must request new links.

5. Create the Radon instance

Wire the pieces together in one file you'll import everywhere:

lib/auth.ts
import { Radon } from "@radonsdk/auth";
import { postgresAdapter } from "@radonsdk/auth/adapters/postgres";
import { resendSender } from "@radonsdk/auth/senders/resend";
import { Pool } from "pg";

const pool = new Pool({ connectionString: process.env.DATABASE_URL });

export const auth = new Radon({
  adapter: postgresAdapter(pool),
  session: { secret: process.env.RADON_SECRET! },
  appName: "Acme",
  providers: {
    emailCode: {
      sender: resendSender({ apiKey: process.env.RESEND_API_KEY!, from: "Acme <auth@acme.com>" }),
    },
  },
});

That's a real, minimal config

adapter is required, session.secret is required, and every providers entry is optional — enable exactly the sign-in methods you want. Everything else has a sensible default.

6. Create the database tables

SQL databases need Radon's tables. Run this once (it's safe to run repeatedly — it only creates what's missing):

scripts/init-db.ts
import { auth } from "../lib/auth";

await auth.init();

Where to call init()

Call auth.init() in a migration script, or once on server boot. With the Prisma, Supabase, or Firebase adapters, your schema tool manages tables instead — those adapters skip this step. init() also verifies your Radon Pro license when you've configured Pro providers.

You're ready

Next, mount Radon into your framework and ship your first sign-in flow.

On this page