The core engine persists users, sessions, password resets, and signing keys through an AuthStorage interface. The interface defines full CRUD for each record, plus session cleanup and signing-key management. Any storage backend that implements it works; the contract is covered by the same tests across adapters.
| Package | Use for |
|---|---|
@palmshed/auth-storage-postgres | Production. Runs schema creation via migrate() |
@palmshed/auth-storage-sqlite | Local development and small deployments |
@palmshed/auth-storage-redis | Distributed rate-limit counters (with the core engine) |
MemoryStorage (in core) | Tests and ephemeral use; data is lost on restart |
import { PostgresStorage } from "@palmshed/auth-storage-postgres";
const storage = new PostgresStorage(process.env.DATABASE_URL);
await storage.migrate(); // creates the schema if neededTables live in a dedicated auth schema. Sessions and password resets cascade when a user is deleted. Signing keys are stored in the database so token verification works across restarts and instances.
Session tokens are HMAC-signed with a signing key held in storage. The manager rotates keys automatically, keeps several active keys for verification, and retires old keys after a grace period. This is what makes tokens survive a restart and multiple instances.