OAuth Client for JavaScript (Node.js): Overview and Usage Examples

Overview of OAuth Client Libraries for JavaScript (Node.js)

OAuth (Open Authorization) is an open authorization protocol that allows a third party to be granted limited access to a user's resources without sharing their login and password. In the Node.js ecosystem, there are several mature libraries implementing OAuth 2.0 and OAuth 1.0a. In this article, we will look at three of the most popular solutions: simple-oauth2, oauth4webapi, and Passport.js with its strategies. You will learn how to choose the right tool and how to integrate it into your project.

1. simple-oauth2 — Universal OAuth 2.0 Client

simple-oauth2 is a lightweight library that provides a clean API for working with OAuth 2.0. It supports all major grant types (authorization code, client credentials, password, refresh token). It is ideal for server-side applications where full control over the process is needed.

Installation

npm install simple-oauth2

Example: Authorization via GitHub

const express = require('express');const simpleOAuth2 = require('simple-oauth2');const app = express();

const config = {  client: {    id: 'YOUR_CLIENT_ID',    secret: 'YOUR_CLIENT_SECRET'  },  auth: {    tokenHost: 'https://github.com',    tokenPath: '/login/oauth/access_token',    authorizePath: '/login/oauth/authorize'  }};

const oauth2 = new simpleOAuth2.ClientCredentials(config);

// Route to start authorizationapp.get('/auth/github', (req, res) => {  const authorizationUri = oauth2.authorizeURL({    redirect_uri: 'http://localhost:3000/callback',    scope: 'user:email'  });  res.redirect(authorizationUri);});

// Callback routeapp.get('/callback', async (req, res) => {  const { code } = req.query;  try {    const result = await oauth2.getToken({      code,      redirect_uri: 'http://localhost:3000/callback'    });    const accessToken = oauth2.createToken(result);    console.log('Access Token:', accessToken.token.access_token);    res.send('Authorization was successful!');  } catch (error) {    console.error('Error getting token', error);    res.status(500).send('Authorization error');  }});

app.listen(3000, () => console.log('Server running on port 3000'));

2. oauth4webapi — Modern Standard

oauth4webapi is an implementation of the latest OAuth 2.0 and OpenID Connect specifications. The library has no external dependencies, supports PKCE (Proof Key for Code Exchange) and working with JWK (JSON Web Keys). It is recommended for new projects where security and standards compliance are important.

Installation

npm install oauth4webapi

Example: Authorization with PKCE

const express = require('express');const { AuthorizationServer, Client, generateCodeVerifier, generateCodeChallenge } = require('oauth4webapi');const app = express();

// Authorization server configuration (Google)const issuer = new URL('https://accounts.google.com');const server = new AuthorizationServer(issuer);const client = new Client({  client_id: 'YOUR_CLIENT_ID',  client_secret: 'YOUR_CLIENT_SECRET',  redirect_uris: ['http://localhost:3000/callback']});

app.get('/auth/google', async (req, res) => {  const codeVerifier = generateCodeVerifier();  const codeChallenge = await generateCodeChallenge(codeVerifier);    // Save codeVerifier in session  req.session.codeVerifier = codeVerifier;

  const authorizationUrl = new URL(server.authorization_endpoint);  authorizationUrl.searchParams.set('client_id', client.client_id);  authorizationUrl.searchParams.set('redirect_uri', client.redirect_uris[0]);  authorizationUrl.searchParams.set('response_type', 'code');  authorizationUrl.searchParams.set('scope', 'openid profile email');  auth