oauth4webapi

Low-Level OAuth 2 / OpenID Connect Client API for JavaScript Runtimes

This software provides a collection of routines that can be used to build client modules for OAuth 2.1, OAuth 2.0 with the latest Security Best Current Practices (BCP), and FAPI 2.0, as well as OpenID Connect where applicable. The primary goal of this software is to promote secure and up-to-date best practices while using only the capabilities common to both browser and non-browser JavaScript runtimes.

Features

The following features are currently in scope and implemented in this software:

Authorization Server Metadata discovery
Resource Server Metadata discovery
Authorization Code Flow (profiled under OpenID Connect 1.0, OAuth 2.0, OAuth 2.1, and FAPI 2.0), with PKCE
Refresh Token, Device Authorization, Client-Initiated Backchannel Authentication (CIBA), and Client Credentials Grants
Demonstrating Proof-of-Possession at the Application Layer (DPoP)
Token Introspection and Revocation
Pushed Authorization Requests (PAR)
UserInfo and Protected Resource Requests
Authorization Server Issuer Identification
JWT Secured Introspection, Response Mode (JARM), Authorization Request (JAR), and UserInfo
Dynamic Client Registration (DCR)
Validating incoming JWT Access Tokens

Sponsor

If you want to quickly add authentication to JavaScript apps, feel free to check out Auth0's JavaScript SDK and free plan. Create an Auth0 account; it's free!

Certification

Filip Skokan has certified that this software conforms to the Basic, FAPI 1.0, and FAPI 2.0 Relying Party Conformance Profiles of the OpenID Connect™ protocol.

💗 Help the project

Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by becoming a sponsor.

Dependencies: 0

oauth4webapi has no dependencies and it exports tree-shakeable ESM.

API Reference

oauth4webapi is distributed via npmjs.com, jsr.io, jsdelivr.com, and github.com.

Examples

example ESM import¹

import * as oauth from 'oauth4webapi'

Authorization Code Flow (OAuth 2.0) - source
Authorization Code Flow (OpenID Connect) - source | diff
Extensions
- DPoP - source | diff
- JWT Secured Authorization Request (JAR) - source | diff
- JWT Secured Authorization Response Mode (JARM) - source | diff
- Pushed Authorization Request (PAR) - source | diff
Client Authentication
Other Grants
- Client Credentials Grant - source
- Client-Initiated Backchannel Authentication Grant (CIBA) - source
- Device Authorization Grant - source
- Refresh Token Grant - source | diff
FAPI
- FAPI 1.0 Advanced - source | diff
- FAPI 2.0 Security Profile - source | diff
- FAPI 2.0 Message Signing - source | diff

Supported Runtimes

The supported JavaScript runtimes include those that support the utilized Web API globals and standard built-in objects. These are (but are not limited to):

Browsers
Bun
Cloudflare Workers
Deno
Electron
Node.js²

Supported Versions

Version	Security Fixes 🔑	Other Bug Fixes 🐞	New Features ⭐
v3.x	Security Policy	✅	✅

CJS style let oauth = require('oauth4webapi') is possible in Node.js versions where the require(esm) feature is enabled by default (^20.19.0 || ^22.12.0 || >= 23.0.0). ↩
Node.js v20.x as baseline is required ↩