Starting a new Spring Boot project usually feels great.
You create the project, add a few dependencies, write your first controller...
Then authentication enters the chat.
Suddenly you're configuring:
- Spring Security
- JWT access tokens
- refresh tokens
- roles and permissions
- password hashing
- exception handling
- database migrations
Three hours later, your original feature still has exactly zero lines of code.
Congratulations. You built authentication again.
The auth code isn't the interesting part
Most applications need roughly the same authentication foundation.
Register a user.
Login.
Return an access token.
Refresh it safely.
Protect endpoints.
Check roles.
Logout.
Maybe add passkeys, OAuth, account recovery, or multiple sessions later.
None of this is particularly unique to your SaaS, internal tool, API, or side project.
But we keep rebuilding it.
I was doing the same thing with my Spring Boot projects, so I eventually turned that repeated setup into AuthKit.
AuthKit Lite
AuthKit Lite is the free and open-source version.
It gives you a working Spring Boot authentication foundation with:
- JWT access tokens
- rotating refresh tokens
- Spring Security
- role-based authorization
- BCrypt passwords
- optional WebAuthn passkeys
- Flyway migrations
- H2 for instant local testing
- MySQL support
- integration tests
- a browser-based API testing page
The goal is simple:
Clone → run → test the APIs → start building your application.
git clone https://github.com/buildbasekit/AuthKit-Lite.git
cd AuthKit-Lite
./mvnw spring-boot:run
Then open:
http://localhost:8080/api-test
No Docker ceremony.
No spending your evening creating JWT filters for the 17th time.
No pretending you'll "clean up the auth code later."
You can find AuthKit Lite here:
https://buildbasekit.com/boilerplates/authkit-lite/
When Lite isn't enough
Basic authentication is enough for many projects.
But production applications often grow into things like:
- email verification
- password recovery
- multiple user sessions
- session revocation
- refresh-token replay protection
- OAuth2 / OIDC
- account linking
- magic links
- passkeys
- account lifecycle handling
That is where AuthKit Pro comes in.
It takes the same idea further: provide the authentication foundation while keeping the application-specific business logic in your application.
The important part for me was avoiding a giant framework that tries to own the entire application.
Auth should be infrastructure.
Not your new hobby.
AuthKit Pro is here:
https://buildbasekit.com/boilerplates/authkit-pro
Lite or Pro?
The easiest way to think about it:
AuthKit Lite
Use it when you need a clean Spring Boot authentication starting point or want to understand and extend the implementation yourself.
It's free and open source.
AuthKit Pro
Use it when the project needs more complete authentication flows and production-focused session and account lifecycle features.
Both are source-code foundations.
You still own the application.
You can change the architecture.
You can remove features.
You can add your own authorization rules.
And your business logic doesn't have to live inside somebody else's authentication service.
Why a boilerplate?
I'm not trying to eliminate authentication decisions.
You still need to decide things like:
- token lifetimes
- authorization rules
- production secrets
- rate limiting
- monitoring
- application-specific permissions
A boilerplate just means you don't have to start those decisions from an empty SecurityConfig.java.
That's the part I wanted to solve.
Because there are much more interesting bugs waiting for us in the actual product.
AuthKit Lite — Free & Open Source
https://buildbasekit.com/boilerplates/authkit-lite/
AuthKit Pro — Production-Focused
https://buildbasekit.com/boilerplates/authkit-pro
Built with Spring Boot and Spring Security.
If you're building Spring Boot APIs, I'd also be interested to know:
Do you rebuild authentication for every project, maintain your own starter, or use an external identity provider?