Skip to main content
authplaneProvider wires authentication through Authplane, so your tools receive a signed-in user.

​
Example

server.ts

​
Signature

​
Parameters

​
opts

  • issuer is the authorization server’s issuer identifier, for example https://auth.acme.com.
  • resource is this server’s resource identifier: the public URL clients reach, advertised in its protected-resource metadata. Required, unlike the other providers — see below.
  • audience overrides the expected aud, which defaults to resource. Set it only when the resource is configured in Authplane with an explicit audience override.
It also accepts the shared CustomProviderOptions options: serverUrl, scopes, requiredScopes, and metadataOverrides. Dynamic Client Registration is supported natively, so clients register directly with Authplane and this server stays out of the authorization path.

​
Why resource is required

Authplane binds the access token’s aud to the RFC 8707 resource indicator the client sends, and the client reads that value from the resource field of this server’s protected-resource metadata. Setting resource gives the deployment one fixed identifier for both, so it is required rather than optional. Three values must therefore be identical, and OAuth compares identifiers by exact string match:
  1. the value this server advertises as its resource metadata;
  2. the resource registered in Authplane;
  3. the aud Authplane mints, which it takes from (2).
A mismatch between 1 and 2 fails the authorization request with invalid_target, before any token exists; between 1 and 3, token verification fails. Register resource in Authplane character for character and all three agree.

​
Pathless origins

The advertised resource is the URL-normalised form of resource, so a bare origin is advertised with a root path: https://acme.example.com is advertised as https://acme.example.com/. The provider asks for the advertised form up front, and names it if the two differ:
So if your resource is a bare origin, register it in Authplane with the trailing slash. Uppercase hosts and explicit default ports normalise the same way. Path-qualified URLs are unchanged by normalisation, and are the most specific identifier available — which is what RFC 8707 §2 asks clients to send.

​
Returns

A Promise for the OAuthConfig you pass to the oauth constructor option.

Connect an Identity Provider

Set up sign-in with a hosted provider

Authenticate Users

Add sign-in to your app end to end

customProvider

Wire OAuth from any IdP’s discovery document