Lacspace Devs
← All packages

@lacspace/oauth

v1.0.0Security Kit1 @lacspace dep

OAuth 2.1 / OpenID Connect client for social login — Google, GitHub, Microsoft, Apple, GitLab, Discord, Slack, LinkedIn, Facebook, X, Spotify, Twitch, Notion, and any OIDC issuer via discovery (Auth0, Okta, Keycloak, Cognito). PKCE, state, nonce, ID-token verification over JWKS, refresh, revoke, normalised profiles. Every preset is cross-checked against the provider's live discovery document. Web Crypto, injectable fetch, isomorphic.

npm i @lacspace/oauth
View on npm ↗GitHub ↗

Usage

oauth.ts
import { createOAuthClient, google } from "@lacspace/oauth";

const client = createOAuthClient(google({ clientId, clientSecret, redirectUri: "https://app.example.com/auth/google/callback" }));

// 1. redirect — store state, codeVerifier and nonce (e.g. @lacspace/session's OAuth state store)
const { url, state, codeVerifier, nonce } = await client.authorizationUrl({ prompt: "select_account" });

// 2. callback — state ✓ PKCE ✓ nonce ✓ ID token verified over JWKS ✓
const tokens  = await client.handleCallback(req.url, { state, codeVerifier, nonce });
const profile = await client.userInfo(tokens);
// { id: "1088…", email: "ada@example.com", emailVerified: true, name: "Ada Lovelace", picture: "https://…" }

// any OIDC issuer: oidc({ issuer: "https://acme.eu.auth0.com/", clientId, clientSecret, redirectUri })

Exports 30

createOAuthClientOAuthErrorgooglegithubmicrosoftapplecreateAppleClientSecretgitlabdiscordslacklinkedinfacebookxspotifytwitchnotionoidcauth0oktakeycloakcognitooauth2providersdiscoveroidcProfilegenerateCodeVerifiercodeChallengeS256generateStategenerateNonceaccessTokenHash

Keywords

oauthoauth2oidcopenid-connectsocial-loginsign-in-with-googlesign-in-with-applegithub-loginpkceid-tokenjwksauth

More in Security Kit

@lacspace/apikey

Issue & verify API keys the right way — prefixed high-entropy keys, store only the SHA-256 hash, constant-time verify, plus a storage-agnostic record toolkit: public fingerprints, hierarchical scopes, expiry, key rotation with a grace window, and revocation. Isomorphic over Web Crypto.

@lacspace/crypto

Safe, boring cryptography over Web Crypto — authenticated AES-256-GCM, PBKDF2/HKDF key derivation, SHA-256/384/512, HMAC, timing-safe compare and unbiased secure random (tokens, UUIDs, integers). Isomorphic (Node, edge, browser, RN).

@lacspace/headers

Secure HTTP headers & a typed Content-Security-Policy builder — HSTS, CSP nonces & hashes, a typed Permissions-Policy, COOP/COEP/CORP cross-origin isolation, Reporting-Endpoints and report-only, plus ready-made strict and API presets. Framework-agnostic + Next.js. Zero-dependency, isomorphic.

@lacspace/jwt

JSON Web Tokens over Web Crypto — HS/RS/ES/EdDSA signing, JWK/JWKS with kid-based key rotation, and strict expiry/issuer/audience/subject/jti checks. Plus refresh-token rotation and CSRF tokens. Isomorphic — Node, edge, browser.

@lacspace/lock

Account lockout & brute-force protection (server lock) — N-strikes with exponential or progressive/tiered backoff, per-account + per-IP composite locking, allow/deny lists, and a CAPTCHA step-up threshold before hard lockout. Pluggable store, zero-dependency, isomorphic.

@lacspace/mfa

Orchestrate multi-factor auth — combine password + TOTP + passkeys into 2FA/3FA step-up flows with NIST assurance levels (AAL), now with factor enrollment flows, failed-attempt lockout, trusted-device tokens and recovery codes. Isomorphic (bar @lacspace/otp).

← Browse all 133 packagesRead the handbook