Most side projects don't die on the main feature. They die on the second project hiding inside the first one: auth.
You start out building the thing you actually care about, and then a week disappears into sessions, password resets, login pages, and the question of where tokens live. Add passkeys or MFA and that's another library, another set of docs, another thing to keep in sync with the rest of your backend.
Yatta JS takes a different shape. It's a backend-as-a-server for Bun: one process with your database, auth, mail, storage, realtime, jobs and observability baked in. Auth isn't a service you bolt on — it sits in the same process as the data it protects, next to the same database and the same job queue.
That changes the order of work. Instead of wiring up an auth provider, then a database, then a session store, and then debugging how the three talk to each other, you start with a backend that already has auth in it — including passkeys and MFA — and you go straight to building the feature your users will actually see.
The practical payoff is smaller, not grander. Fewer moving parts means fewer places for a login flow to break at 2am. One process means one log stream when something does go wrong. And when you're ready to ship, the same CLI that checks the rest of the backend — doctor, migrate, backup — covers the whole thing, auth included.
None of this replaces good auth judgment. You still have to decide who can do what in your app, and you still have to think about recovery when someone loses a device. What a bundled backend removes is the plumbing tax: the weeks spent assembling an auth stack before you've shipped anything worth protecting.
If you're building a solo project and auth is the part you've been putting off, that's the test. Try starting from a backend where auth is already there, and see how much sooner you get to the part you actually wanted to build.
Yatta JS is open source under MIT, on npm as yatta.js. Docs: https://yatta.js.org — Code: https://github.com/psrockstar098/yatta.js
What's the auth feature you keep postponing — passkeys, MFA, or just getting sessions right?
