About
We got tired of rebuilding sign-in
Every product we shipped started the same way: two or three weeks on authentication, organisations and billing before touching the thing customers actually wanted. So we wrote it once, properly, and kept it maintained.
Readable over clever
You will read this code more often than you write it. Every abstraction has to earn the indirection it adds.
Secure by default
Authorisation is checked on the server, in every action, every time. Defaults should be the safe option, not the convenient one.
Yours to change
No hidden package, no locked configuration. You get the source and you can rewrite any part of it.