A unified OAuth proxy supporting 200+ providers with middleware for Express, Koa, Hapi, Fastify, and serverless functions.
Grant is an OAuth proxy that streamlines authentication with over 200 providers, including major platforms like Google, GitHub, and Twitter. It handles OAuth 1.0a, OAuth 2.0, OpenID Connect, and PKCE flows, reducing the boilerplate code needed for secure social logins and API integrations.
Backend and full-stack developers building web applications or APIs that require OAuth-based authentication, especially those using Node.js frameworks like Express, Koa, Hapi, or Fastify, or deploying serverless functions.
Developers choose Grant for its extensive provider support, framework flexibility, and dynamic configuration capabilities, which allow for rapid integration of OAuth without being locked into a specific stack or provider implementation.
OAuth Proxy
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Unifies configuration for over 200 OAuth providers, including Google, GitHub, and Twitter, eliminating the need to write custom integration code for each, as detailed in the README's comprehensive list.
Offers middleware for Express, Koa, Hapi, Fastify, and serverless environments like AWS Lambda and Vercel, allowing seamless integration across diverse Node.js stacks and deployments.
Enables runtime overrides of provider settings via HTTP requests or application state, making it usable as a transparent OAuth proxy for dynamic applications, as explained in the dynamic configuration section.
Includes support for state, nonce, PKCE, and basic OpenID Connect token validation (aud and nonce), securing authentication flows without requiring manual implementation of these protocols.
Requires session management for OAuth state persistence, which adds complexity for stateless architectures or serverless functions where sessions aren't natively supported, as noted in the handler setup requirements.
Does not verify the signature of id_tokens by default, only validating aud and nonce claims, which may necessitate additional security checks by developers for full OpenID Connect compliance.
The hierarchical configuration with defaults, providers, overrides, and dynamic options can be intricate and error-prone, especially for those new to OAuth or dealing with multiple providers.