Installations
npm install @redwoodjs/authDeveloper Guide
Typescript
Yes
Module System
ESM
Node Version
20.18.2
NPM Version
lerna/8.1.9/node@v20.18.2+arm64 (darwin)
Score
93.3
Supply Chain
98.7
Quality
99.1
Maintenance
100
Vulnerability
100
License
Releases
Contributors
Languages
TypeScript (63.4%)
JavaScript (35.85%)
CSS (0.4%)
HTML (0.12%)
Shell (0.09%)
Dockerfile (0.07%)
XS (0.03%)
MDX (0.03%)
Developer
Download Statistics
Total Downloads
5,951,008
Last Day
3,813
Last Week
15,716
Last Month
63,727
Last Year
3,282,879
GitHub Statistics
17,470 Stars
12,026 Commits
1,006 Forks
98 Watching
91 Branches
444 Contributors
Maintainers
Package Meta Information
Latest Version
8.5.0
Package Id
@redwoodjs/auth@8.5.0
Unpacked Size
116.86 kB
Size
15.32 kB
File Count
119
NPM Version
lerna/8.1.9/node@v20.18.2+arm64 (darwin)
Node Version
20.18.2
Publised On
26 Jan 2025
Total Downloads
Cumulative downloads
Total Downloads
5,951,008
Last day
23.2%
3,813
Compared to previous day
Last week
-20.9%
15,716
Compared to previous week
Last month
6.9%
63,727
Compared to previous month
Last year
144.9%
3,282,879
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Redwood
by Tom Preston-Werner, Peter Pistorius, Rob Cameron, David Price, and more than 250 amazing contributors (see end of file for a full list).
Bighorn Epoch (current development epoch)
NOTE: This section of the Readme is aspirational for the current development epoch we call Bighorn. Bighorn has not yet been released, but when it is, it will fulfill the promises of what you read below. If you’d like to help us on this journey, please say hi in the Community Forums!
Redwood is a framework for quickly creating React-based web applications that provide an amazing end user experience. Our goal is to be simple and approachable enough for use in prototypes and hackathons, but performant and comprehensive enough to evolve into your next startup.
We accomplish this in two primary ways:
-
Redwood is opinionated and full-stack. We’ve chosen the best technologies in the JS/TS ecosystem and beautifully integrated them into a cohesive framework that lets you get things done instead of endlessly evaluating technology options. You can get started using Redwood without a backend, but the framework really shines when you’re building a data driven application. Our transparent data fetching and optional GraphQL API make building and growing your application easier than you expect!
-
Redwood’s declarative data fetching and simple form submission features are built on top of RSC + Server Actions and simplify common use cases so you can focus on your users’ experience. Creating the best, most responsive user interfaces requires reasoning about whether code should execute on the server or the client. Redwood makes it easy to choose the best execution context for your code by leveraging the power of React Server Components.
The entire framework is built with TypeScript, so you get type safety from the router to the database and everywhere in-between. If you’d rather build your app with JavaScript, you can do that too, and still enjoy great code completion features in your favorite editor.
TRY BIGHORN: While Bighorn does not yet have a production release, we do publish the latest code as canaries, and we welcome you to experiment with them! The best way to get familiar with these canaries is to keep an eye on the Redwood Blog.
Arapahoe Epoch (current stable release)
Redwood is an opinionated, full-stack, JavaScript/TypeScript web application framework designed to keep you moving fast as your app grows from side project to startup.
At the highest level, a Redwood app is a React frontend that talks to a custom GraphQL API. The API uses Prisma to operate on a database. Out of the box you get tightly integrated testing with Jest, logging with Pino, and a UI component catalog with Storybook. Setting up authentication (like Auth0) or CSS frameworks (like Tailwind CSS) are a single command line invocation away. And to top it off, Redwood's architecture allows you to deploy to either serverless providers (e.g. Netlify, Vercel) or traditional server and container providers (e.g. AWS, Render) with nearly no code changes between the two!
By making a lot of decisions for you, Redwood lets you get to work on what makes your application special, instead of wasting cycles choosing and re-choosing various technologies and configurations. Plus, because Redwood is a proper framework, you benefit from continued performance and feature upgrades over time and with minimum effort.
TUTORIAL: The best way to get to know Redwood is by going through the extensive Redwood Tutorial. Have fun!
QUICK START: You can install and run a full-stack Redwood application on your machine with only a couple commands. Check out the Quick Start guide to get started.
DOCS: Visit the full RedwoodJS Documentation for extensive reference docs and guides.
About
Redwood is the latest open source project initiated by Tom Preston-Werner, cofounder of GitHub (most popular code host on the planet), creator of Jekyll (one of the first and most popular static site generators), creator of Gravatar (the most popular avatar service on the planet), author of the Semantic Versioning specification (powers the Node packaging ecosystem), and inventor of TOML (an obvious, minimal configuration language used by many projects).
Technologies
We are obsessed with developer experience and eliminating as much boilerplate as possible. Where existing libraries elegantly solve our problems, we use them; where they don't, we write our own solutions. The end result is a JavaScript development experience you can fall in love with!
Here's a quick taste of the technologies a standard Redwood application will use:
If you'd like to use our optional built-in GraphQL API support, here's our stack:
Roadmap
A framework like Redwood has a lot of moving parts; the Roadmap is a great way to get a high-level overview of where the framework is relative to where we want it to be. And since we link to all of our GitHub project boards, it's also a great way to get involved! Roadmap
Why is it called Redwood?
(A history, by Tom Preston-Werner)
Where I live in Northern California there is a type of tree called a redwood. Redwoods are HUGE, the tallest in the world, some topping out at 115 meters (380 feet) in height. The eldest of the still-living redwoods sprouted from the ground an astonishing 3,200 years ago. To stand among them is transcendent. Sometimes, when I need to think or be creative, I will journey to my favorite grove of redwoods and walk among these giants, soaking myself in their silent grandeur.
In addition, Redwoods have a few properties that I thought would be aspirational for my nascent web app framework. Namely:
-
Redwoods are beautiful as saplings, and grow to be majestic. What if you could feel that way about your web app?
-
Redwood pinecones are dense and surprisingly small. Can we allow you to get more done with less code?
-
Redwood trees are resistant to fire. Surprisingly robust to disaster scenarios, just like a great web framework should be!
-
Redwoods appear complex from afar, but simple up close. Their branching structure provides order and allows for emergent complexity within a simple framework. Can a web framework do the same?
And there you have it.
Contributors
A gigantic "Thank YOU!" to everyone below who has contributed to one or more Redwood projects: Framework, Website, Docs, and Create-Redwood Template. 🚀
Core Team: Leadership
 Amy Haywood Dutton |  David Price |  Tobbe Lundberg |  Tom Preston-Werner |
Core Team: Maintainer and Community Leads
 David Thyresson maintainer |  Daniel Choudhury maintainer |  Keith T Elliot community |  Barrett Burnworth community |  Josh GM Walker maintainer |
Founders
Tom Preston-Werner |  Peter Pistorius |  Rob Cameron | David Price |
Core Team: Alumni
All Contributors
Redwood projects (mostly) follow the all-contributions specification. Contributions of any kind are welcome.
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Reason
project has 53 contributing companies or organizations
Details
- Info: typescript-community contributor org/company found, preston-werner-ventures contributor org/company found, objcio contributor org/company found, puzzmo-com contributor org/company found, decoupled inc contributor org/company found, redwoodjs contributor org/company found, NSManchester contributor org/company found, Moya contributor org/company found, twoslashes contributor org/company found, treasure-chess contributor org/company found, tsnyc contributor org/company found, spoke-run contributor org/company found, forkjoin contributor org/company found, shibapm contributor org/company found, danger contributor org/company found, xcpretty contributor org/company found, storybookjs contributor org/company found, cengys contributor org/company found, UseKeyp contributor org/company found, preston-werner ventures contributor org/company found, replay.io contributor org/company found, METEOplus contributor org/company found, relay-tools contributor org/company found, RxSwiftCommunity contributor org/company found, open-dollar contributor org/company found, radioactive contributor org/company found, osscommunity contributor org/company found, MakeHartford contributor org/company found, chatterbugapp @redwoodjs @preston-werner-ventures contributor org/company found, koala-interactive contributor org/company found, github-beta contributor org/company found, CocoaPods contributor org/company found, PutioKit contributor org/company found, SwiftJava contributor org/company found, toml-lang contributor org/company found, sydnod contributor org/company found, styled-components contributor org/company found, camerontech contributor org/company found, beep boop contributor org/company found, mariomakerbookclub contributor org/company found, jestjs contributor org/company found, jest-community contributor org/company found, ah ha creative contributor org/company found, snaplet @redwoodjs contributor org/company found, Farata contributor org/company found, RubyNative contributor org/company found, forms-js contributor org/company found, graphql contributor org/company found, react-native-community contributor org/company found, snaplet contributor org/company found, specta contributor org/company found, flappy-royale contributor org/company found, tsconfig contributor org/company found,
Reason
no dangerous workflow patterns detected
Reason
update tool detected
Details
- Info: detected update tool: RenovateBot: .github/renovate.json:1
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
30 commit(s) and 3 issue activity found in the last 90 days -- score normalized to 10
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
GitHub workflow tokens follow principle of least privilege
Details
- Info: jobLevel 'issues' permission set to 'read': .github/workflows/require-release-label.yml:21
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/require-release-label.yml:22
- Info: found token with 'none' permissions: .github/workflows/check-changelog.yml:1
- Info: found token with 'none' permissions: .github/workflows/check-create-redwood-app.yml:1
- Info: found token with 'none' permissions: .github/workflows/check-test-project-fixture.yml:1
- Info: found token with 'none' permissions: .github/workflows/ci.yml:1
- Info: found token with 'none' permissions: .github/workflows/codeql-analysis.yml:1
- Info: found token with 'none' permissions: .github/workflows/publish-canary.yml:1
- Info: found token with 'none' permissions: .github/workflows/publish-release-candidate.yml:1
- Info: found token with 'none' permissions: .github/workflows/require-milestone.yml:1
- Info: found token with 'none' permissions: .github/workflows/require-release-label.yml:1
- Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18
- Info: no jobLevel write permissions found
Reason
dependency not pinned by hash detected -- score normalized to 6
Details
- Warn: containerImage not pinned by hash: packages/cli/src/commands/setup/docker/templates/Dockerfile:3
- Warn: containerImage not pinned by hash: packages/cli/src/commands/setup/docker/templates/Dockerfile:36
- Warn: containerImage not pinned by hash: packages/cli/src/commands/setup/docker/templates/Dockerfile:48
- Warn: containerImage not pinned by hash: packages/cli/src/commands/setup/docker/templates/Dockerfile:55
- Warn: containerImage not pinned by hash: packages/cli/src/commands/setup/docker/templates/Dockerfile:62
- Warn: containerImage not pinned by hash: packages/cli/src/commands/setup/docker/templates/Dockerfile:106
- Warn: containerImage not pinned by hash: packages/cli/src/commands/setup/docker/templates/Dockerfile:139
- Info: 37 out of 37 GitHub-owned GitHubAction dependencies pinned
- Info: 6 out of 6 third-party GitHubAction dependencies pinned
- Info: 0 out of 7 containerImage dependencies pinned
Reason
Found 14/27 approved changesets -- score normalized to 5
Reason
badge detected: InProgress
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
12 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m / GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-pqhp-25j4-6hq9
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-pfq8-rq6v-vf5m
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
7.6
/10
Last Scanned on 2024-12-26T09:04:01Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More