---
title: auth-password
description: Add password registration and login to the auth anchor.
---

Install `auth-password` when the host needs password registration and login.
It depends on `auth`.

```sh
lenso module install auth
lenso module install auth-password
cargo run --bin migrate
lenso serve
```

After installing `auth-password`, register and log in through the password
routes:

```sh
curl -sS -X POST http://127.0.0.1:3000/v1/auth/password/register \
  -H 'content-type: application/json' \
  -d '{"identifier":"ada@example.com","password":"correct horse battery staple"}' | jq .

curl -sS -X POST http://127.0.0.1:3000/v1/auth/password/login \
  -H 'content-type: application/json' \
  -d '{"identifier":"ada@example.com","password":"correct horse battery staple"}' | jq .
```

The response includes `user_id`, `token`, `expires_at`, and a `session_id` when
the token strategy is database-backed sessions.

`user_id` is the `auth.users` id. Use it as the product actor id, or store it in
your own profile/account table as `auth_user_id`. `auth-password` does not create
a separate Console user.

After restart, verify:

- the connected Console lists both `auth` and `auth-password`.
- runtime observation shows auth password HTTP routes after requests.
- `auth-password.token_strategy` appears in runtime config.

## JWT mode

`auth-password` defaults to session tokens. To issue JWTs, set runtime config
`auth-password.token_strategy=jwt` and provide a secret. For local host config,
prefer module-local env:

```sh
LENSO_MODULE_AUTH_PASSWORD__JWT_SECRET=dev-only-change-me
```

Runtime config keys for JWT mode include:

- `auth-password.jwt_secret`
- `auth-password.jwt_issuer`
- `auth-password.jwt_audience`
- `auth-password.jwt_ttl_hours`

## Manual Rust composition

Most hosts should use `lenso module install`. For hand-written host composition,
use the public builtins exposed by the `host` feature:

```rust
use lenso::host::prelude::*;

pub fn host_composition() -> HostComposition {
    HostBuilder::new()
        .linked_module(builtins::auth())
        .linked_module(builtins::auth_password())
        .build()
}
```

Run migrations after changing linked module composition:

```sh
cargo run --bin migrate
```