No Code Authentication

Authentication is one of the most security-critical parts of any web application, yet it is also one of the most commonly implemented incorrectly. Custom authentication systems introduce risk at every layer: password hashing algorithms, session management, token rotation, CSRF protection, and rate limiting all need to be implemented correctly. A single vulnerability in any of these areas can compromise your entire user base. Fabricate reduces this risk by generating auth from starter templates that already use vetted primitives - bcrypt for password hashing and signed JWTs for sessions - rather than improvising a scheme per project.

When you tell Fabricate to add user accounts, it generates the auth layer directly into your project: a users table, a sessions table, registration and login endpoints, and middleware that validates the session token on protected routes. Passwords are hashed with bcrypt and never stored or logged in plain text. Because the code lives in your repository, you can read it, test it, and change it - there is no vendor SDK between you and your own user data.

The user experience layer is generated to match your application's design system. Login and signup screens are created with your app's color scheme, typography, and layout patterns. These are not generic modal overlays but fully integrated pages that feel native to your application.

Role-based access control goes beyond simple admin and user distinctions. Fabricate can generate complex permission systems where different roles have access to different features, pages, and API endpoints. The AI automatically creates middleware that checks permissions before rendering protected content or processing API requests, ensuring your authorization logic is consistent across the entire application.

For applications that require team or organization features, Fabricate generates multi-tenant authentication with workspace isolation. Users can belong to multiple organizations, each with its own set of roles and permissions. Invitations, team management interfaces, and organization switching are all generated as part of the authentication setup.

Authentication is generated into your own project rather than delegated to a hosted identity vendor. The starter schema defines a users table - email, display name, password hash, provider fields, verification flag, failed-attempt counter, lockout timestamp - and a sessions table holding a hashed token alongside device, user agent, and IP metadata. Both live in your D1 database via Drizzle ORM.

The API surface is a set of ordinary routes on your Cloudflare Worker: register, login, logout, log out of every session, and read or update the current profile. Registration hashes the password with bcrypt before it is ever written. Login verifies the hash, mints a signed JWT, and records a session row so the token can be revoked later - logging out invalidates server-side state rather than merely deleting a cookie.

Protected routes run auth middleware that verifies the JWT signature, loads the session, and rejects anything revoked or expired before your handler executes. The authenticated user is attached to the request context, so authorization checks read from typed data instead of re-parsing tokens.

Anything beyond this baseline is generated on request rather than assumed. OAuth providers, email verification delivery, multi-factor authentication, roles, and organization or multi-tenant models are all things you ask for in plain English; the AI extends the same schema and middleware instead of bolting on a parallel system. Fabricate uses Clerk to sign you in to fabricate.build - that is the platform account, not the auth inside the apps you generate.