ShrouDB
Add sign-up, login, and sessions

Sigil

User accounts, passwords, sessions, and JWTs.

Define a user schema, then create users, verify passwords, and issue access and refresh tokens. Sensitive fields are encrypted with Cipher. Sigil also serves REST endpoints for login, token refresh, and JWKS that a browser or mobile app can call directly.

Use it from your app

typescript
import { ShrouDB } from "@shroudb/sdk";

const db = new ShrouDB({
  moat: process.env.SHROUDB_URL,   // e.g. http://localhost:8200
  token: process.env.SHROUDB_TOKEN,
});

// Sign-up
await db.sigil.userCreate("app", userId, {
  email: "alice@example.com",
  password: form.password,
});

// Login: returns an access token and a refresh token
const { access_token, refresh_token } = await db.sigil.sessionCreate(
  "app", userId, form.password,
);

// Browsers can call Sigil's REST endpoints directly:
//   POST /sigil/app/sessions          (login)
//   POST /sigil/app/sessions/refresh  (refresh)
//   GET  /sigil/app/.well-known/jwks.json

What it does

  • You define the user schema. Sensitive fields are encrypted with Cipher.
  • Password hashing, plus import of existing password hashes when you migrate.
  • Access and refresh tokens, with refresh, revoke, and revoke-all.
  • JWKS endpoint so other services can verify tokens.
  • Public REST endpoints for login and refresh, with per-IP rate limiting.
  • Look up users by any indexed field, such as email.

Turn it on

Sigil runs inside Moat, the ShrouDB server. Add this to moat.tomland restart. It shares Moat's encrypted storage, access tokens, and audit log with the other engines.

moat.toml
[engines.sigil]
enabled = true
access_ttl_secs = 900        # 15 minutes
refresh_ttl_secs = 604800    # 7 days
rest_enabled = true          # serve /sigil/* REST endpoints

Commands

Over RESP3, prefix each command with SIGIL. Over HTTP, send POST /v1/sigil {"args": [...]}. The SDKs have a method for each.

CommandArgsDescription
SCHEMA REGISTER<name> <json>Define a user schema
USER CREATE<schema> <id> <json>Create a user
USER GET<schema> <id>Fetch a user
USER LOOKUP<schema> <field> <value>Find a user by field
USER VERIFY<schema> <id> <password>Check a password
SESSION CREATE<schema> <id> <password>Log in and issue tokens
SESSION REFRESH<schema> <refresh_token>Exchange a refresh token
SESSION REVOKE<schema> <token>End a session
PASSWORD RESET<schema> <id> <new>Set a new password
JWKS<schema>Public keys for token verification
Try Sigil locally
The quickstart takes about five minutes.
QuickstartAll engines