This software is a collection of routines upon which framework-specific client modules may be written. Its objective is to support and, where possible, enforce secure and current best practices using only capabilities common to Browser and Non-Browser JavaScript-based runtime environments.

Target profiles of this software are OAuth 2.1, OAuth 2.0 complemented by the latest Security BCP, and FAPI 2.0. Where applicable OpenID Connect is also supported.

• Authorization Server Metadata discovery
• Authorization Code Flow (profiled under OpenID Connect 1.0, OAuth 2.0, OAuth 2.1, and FAPI 2.0), PKCE
• Refresh Token, Device Authorization, and Client Credentials Grants
• Demonstrating Proof-of-Possession at the Application Layer (DPoP)
• Token Introspection and Revocation
• Pushed Authorization Requests (PAR)
• UserInfo and Protected Resource Requests
• Authorization Server Issuer Identification
• JWT Secured Introspection, Response Mode (JARM), Authorization Request (JAR), and UserInfo

Filip Skokan has certified that this software conforms to the Basic RP Conformance Profile of the OpenID Connect™ protocol.

example ESM import

import * as oauth2 from 'oauth4webapi'

example Deno import

import * as oauth2 from 'https://deno.land/x/[email protected]/mod.ts'

• Authorization Code Flow - OpenID Connect source, or plain OAuth 2 source
• Public Client Authorization Code Flow - source | diff from code flow
• Private Key JWT Client Authentication - source | diff from code flow
• DPoP - source | diff from code flow
• Pushed Authorization Request (PAR) - source | diff from code flow
• Client Credentials Grant - source
• Device Authorization Grant - source
• FAPI 2.0 (Private Key JWT, PAR, DPoP) - source
• FAPI 2.0 Message Signing (Private Key JWT, PAR, DPoP, JAR, JARM) - source | diff

The supported JavaScript runtimes include ones that support the utilized Web API globals and standard built-in objects

These are (this is not an exhaustive list):

• Browsers
• Bun
• Cloudflare Workers
• Deno
• Electron
• Node.js (runtime flags may be needed)
• Vercel's Edge Runtime

• CommonJS
• Implicit, Hybrid, and Resource Owner Password Credentials Flows
• Mutual-TLS Client Authentication and Certificate-Bound Access Tokens
• JSON Web Encryption (JWE)
• Automatic polyfills of any kind