Generated Presets
The CLI offers three focused Express API presets and one connected fullstack application preset. Fastify is listed as coming soon.
| Preset | Runtime | Database | Interface |
|---|---|---|---|
| JWT only | Express | Optional Prisma with SQLite or PostgreSQL | API |
| Email + password | Express | Prisma with SQLite or PostgreSQL | API |
| Password + OAuth | Express | Prisma with SQLite or PostgreSQL | API |
| Full-stack application | React/Vite + Express | Prisma with PostgreSQL | Web app + API |
JWT Only (base)
Best for: APIs that manage identities elsewhere
| Feature | Included |
|---|---|
| Public, guest, protected, refresh, and admin routes | ✓ |
| Prisma (optional) | ✓ |
| Redis-backed refresh rotation | ✓ |
| PostgreSQL or SQLite when Prisma is enabled | ✓ |
Email + Password (auth)
Best for: Applications with first-party user accounts
| Feature | Included |
|---|---|
| Registration and login routes | ✓ |
| Secure password hashing | ✓ |
| Prisma enabled automatically | ✓ |
| PostgreSQL or SQLite | ✓ |
Password + OAuth (auth-oauth)
Best for: Applications with multiple sign-in methods
| Feature | Included |
|---|---|
| Everything in password auth | ✓ |
| Google, GitHub, or both | ✓ |
| OAuth account linking | ✓ |
| Redis-backed OAuth state validation | ✓ |
Full-stack Application (fullstack)
Best for: Starting a complete product with authentication, account management, administration, and an example owned resource already connected.
Requirements: Node.js 20.19+, 22.12+, or 24+, npm, and Docker with Compose.
| Feature | Included |
|---|---|
| React, Vite, React Router, and TanStack Query | ✓ |
| Express API with Authenik8 session flows | ✓ |
| Shared Zod contracts and typed API client | ✓ |
| Prisma, PostgreSQL, and Redis | ✓ |
| Login, registration, recovery, verification, and OAuth screens | ✓ |
| Profile, linked providers, password, and active session management | ✓ |
| Admin users, roles, status controls, and audit events | ✓ |
| Owned Project CRUD module with server-side policies | ✓ |
| OpenAPI 3.1, health checks, structured logs, tests, and production docs | ✓ |
The generated npm workspace has explicit boundaries:
apps/
api/ Express, Authenik8, Prisma, PostgreSQL, Redis
web/ React/Vite application
packages/
contracts/ Shared request schemas and public response types
api-client/ Typed browser client and refresh handling
ui/ Reusable application primitives
Access tokens remain in memory. Refresh tokens use a restricted HttpOnly cookie, and API roles and ownership policies remain the authorization boundary.
Local development
npm run docker:up
npm run db:migrate
npm run db:seed
npm run dev
Open http://localhost:5173. The API is available under http://localhost:3000/api.