Why Kavach

Drop-in authentication for SvelteKit with a unified API across backends.

The Problem

Adding auth to a SvelteKit app typically means scattered authentication checks across route files, tight coupling to a specific backend, and manual session management in every load function. Switching auth providers means rewriting auth logic throughout your app.

The Adapter Model

Kavach provides one interface for auth regardless of backend. Configure your adapter once in kavach.config.js — your route protection rules, session handling, and UI components stay the same when you swap backends.

// kavach.config.js — change one line to switch backends
export default {
  adapter: 'firebase',  // was 'supabase' — everything else stays the same
  providers: [...],
  rules: [...]
}

How It Works

The @kavach/vite plugin reads your config at build time and generates the $kavach/auth virtual module. You register kavach.handle as a SvelteKit hook — from that point, every request is protected according to your route rules.

kavach.config.js       adapter, providers, route rules, env var names
        ↓
@kavach/vite plugin    reads config, generates virtual module at build time
        ↓
$kavach/auth           exports: kavach (instance), adapter, logger
        ↓
kavach.handle          SvelteKit server hook — runs on every request
        ↓
sentry                 evaluates route rules against current session
        ↓
session cookie         httpOnly cookie stores access + refresh tokens
        ↓
event.locals.session   available in all load functions and server routes

Key Packages

Next Steps

• Quick Start — get running in minutes
• CLI reference
• Core concepts in depth