A universal JavaScript library for implementing OAuth 2.0 and OpenID Connect client flows across Node.js, browsers, Deno, and other runtimes.
openid-client is a JavaScript library that provides a complete API for implementing OAuth 2.0 and OpenID Connect client-side authentication and authorization flows. It solves the complexity of integrating with authorization servers by offering standardized, easy-to-use methods for discovery, token exchange, and secure resource access across various JavaScript environments.
Developers building applications that require secure authentication with OAuth 2.0 or OpenID Connect providers, including web apps, mobile backends, and serverless functions in Node.js, Deno, Cloudflare Workers, or browsers.
Developers choose openid-client for its comprehensive support of modern OAuth/OpenID Connect standards, universal runtime compatibility, and certification for OpenID Connect Basic, FAPI 1.0, and FAPI 2.0 conformance profiles, ensuring reliable and secure authentication implementations.
OAuth 2 / OpenID Connect Client API for JavaScript Runtimes
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Implements advanced protocols like DPoP, JARM, PAR, and FAPI profiles, ensuring up-to-date security compliance as per the README's feature list.
Runs on multiple JavaScript runtimes including Node.js, browsers, and Cloudflare Workers by relying on standard Web APIs like WebCryptoAPI and Fetch.
Certified for OpenID Connect Basic, FAPI 1.0, and FAPI 2.0 conformance profiles, providing verified reliability and adherence to industry standards.
Includes a ready-to-use strategy for Passport.js, easing integration with Node.js authentication middleware and reducing boilerplate code.
Requires Node.js v20.x as a baseline, which can block adoption in projects stuck on older, long-term support versions.
Developers must handle PKCE, state, and callback logic manually, as shown in the Authorization Code flow example, increasing complexity and error risk.
Beyond Passport, it lacks built-in helpers for common web frameworks, forcing developers to implement redirect and session handling from scratch.