---
title: Official Linked Modules
description: Choose and install the official linked modules known to the Lenso CLI.
---

Lenso does not automatically bundle application modules into every product.
Instead, the CLI knows a maintained set of official **linked modules** that a
Host can install by name. Linked means the Rust module is compiled into and
started with the Host; it is not a separately operated Provider Service.

Use `LENSO_COMPOSITION_PROFILE=core` for a product Host that selects modules
explicitly. The `demo` profile loads the first-party authentication set for
local examples, but production applications should declare what they need.

## Available modules

| Module | Kind | Install | What it owns |
| --- | --- | --- | --- |
| [`auth`](/docs/built-in-modules/auth) | authentication anchor | `lenso module install auth` | users, identities, sessions, actor resolution |
| [`auth-anonymous`](/docs/built-in-modules/auth-anonymous) | auth method | `lenso module install auth-anonymous` | guest sessions and later identity linking |
| [`auth-password`](/docs/built-in-modules/auth-password) | auth method | `lenso module install auth-password` | identifier/password credentials and login |
| [`auth-phone`](/docs/built-in-modules/auth-phone) | auth method | `lenso module install auth-phone` | phone OTP and phone-password login |
| [`auth-oauth`](/docs/built-in-modules/auth-oauth) | auth substrate | `lenso module install auth-oauth` | shared OAuth identities and connection state |
| [`auth-github`](/docs/built-in-modules/auth-github) | auth method | `lenso module install auth-github` | GitHub OAuth login |
| [`auth-google`](/docs/built-in-modules/auth-google) | auth method | `lenso module install auth-google` | Google OAuth/OIDC login |
| [`auth-oidc`](/docs/built-in-modules/auth-oidc) | identity provider | `lenso module install auth-oidc` | OIDC discovery, authorization, and token endpoints |
| [`auth-device`](/docs/built-in-modules/auth-device) | auth policy | `lenso module install auth-device` | device records associated with auth sessions |
| [`organization`](/docs/built-in-modules/organization) | business infrastructure | `lenso module install organization` | organizations, roles, memberships, invitations |
| [`audit-log`](/docs/built-in-modules/audit-log) | business infrastructure | `lenso module install audit-log` | append-only, module-owned audit events |

The CLI resolves these names to exact linked install descriptors, including
dependencies and Cargo packages. `auth`, `auth-password`, and several other
auth modules also have helpers under `lenso::host::builtins`; modules maintained
in independent repositories expose their own `linked_module()` helper.

`lenso/platform-story` is not in this list. It is a composition-selected
Module owned by the application or Console integration that supplies it, not a
Framework-bundled application module.

## Install and verify

Install dependencies first, then restart the Host so migrations, routes, and
Module metadata are loaded:

```sh
lenso module install auth
lenso module install auth-password
cargo run --bin migrate
lenso serve
```

Use the connected Console's Modules view to confirm the resolved dependency and
runtime state. For module authors consuming the authenticated actor, see
[Auth and Capabilities](/docs/auth-capabilities).