Deno

This guide walks you through creating a complete authentication flow using Aura Auth directly with Deno.

Overview

Aura Auth and Deno both follow the web-standard Request and Response interfaces for high-performance HTTP handling. This means Aura Auth works out of the box with Deno.serve, with no external adapters or frameworks required.

Before continuing, complete the installation and initial setup:

• Quick Start Guide to create your Aura Auth instance
• TypeScript Configuration for TypeScript-specific setup
• Deno Integration App for a fully working example

Then use this guide to integrate Aura Auth with a Deno server using best practices.

What You'll Build

You will create a small Deno app with:

• a shared src/lib/auth.ts server configuration
• a src/index.ts entry point that mounts the auth handlers
• a protected route example that validates the current session before responding
• a clear route setup that keeps auth and protected endpoints separate

# 32-bytes (256-bit) secret used to sign/encrypt sessions. Use a secure random value.
AURA_AUTH_SECRET="base64-or-hex-32-bytes"
AURA_AUTH_SALT="base64-or-hex-32-bytes"

import { createAuth } from "npm:@aura-stack/auth"

export const auth = createAuth({
  oauth: ["github"],
  basePath: "/api/auth",
})

export const { handlers, jose, api } = auth

import { handlers } from "./lib/auth.ts"

Deno.serve({ port: 3000 }, async (request) => {
  const pathname = new URL(request.url).pathname

  if (pathname.startsWith("/api/auth/")) {
    return await handlers.ALL(request)
  }

  return new Response("Not Found", { status: 404 })
})

import { auth, handlers } from "./lib/auth.ts"

Deno.serve({ port: 3000 }, async (request) => {
  const pathname = new URL(request.url).pathname

  if (pathname.startsWith("/api/auth/")) {
    return await handlers.ALL(request)
  }

  if (pathname === "/api/protected") {
    const session = await auth.api.getSession({
      headers: request.headers,
    })

    if (!session.authenticated) {
      return Response.json({ error: "Unauthorized", message: "Active session required." }, { status: 401 })
    }

    return Response.json({
      message: "You have access to this protected resource.",
      user: session.session.user,
    })
  }

  return new Response("Not Found", { status: 404 })
})

Common Pitfalls

• Keep basePath aligned with your route logic. If your auth route is /api/auth/*, basePath should be /api/auth.
• Always pass request headers to auth.api.getSession(). The session lookup needs headers so Aura Auth can read cookies.
• Check session.authenticated before exposing private data. Use the authenticated flag to guard sensitive responses.
• Keep the auth route and protected route separate. That makes the server behavior easier to reason about and debug.

Resources

• Deno Documentation
• Aura Auth Documentation
• Deno Integration App
• Integration Guide
• Configuration Reference
• TypeScript Guide