IDaaS Auth JS

Overview

IDaaS Auth JS is the official JavaScript/TypeScript SDK for Entrust Identity-as-a-Service. It wraps hosted OIDC flows, risk-based authentication (RBA) challenges, and “convenience” methods (password, OTP, passkey, soft token, etc.) in a client.

Key features

• Standards-based OIDC authorization-code + PKCE with popup or redirect flows.
• DPoP-bound token support and getDpopHeaders() for DPoP protected resource requests.
• RFC 9470 and RFC 6750 step-up challenge handling via parseResponse(response) for protected API responses.
• Risk-Based Authentication transaction management with challenge/submit/poll/cancel lifecycle.
• Convenience authentication methods for passkeys (WebAuthn), password, OTP, soft token, magic link, face, smart credential, grid, KBA, and temporary access codes.

Create a Free Trial Account

Entrust Identity as a Service (IDaaS) is a cloud-based identity and access management (IAM) solution with multi-factor authentication (MFA), credential-based passwordless access, and single sign-on (SSO).

Get started with a free trial account today.

Configure Your IDaaS Application

1. After logging in as an administrator, navigate to the applications page.
2. Click the plus sign in the top left to create a new application.
3. Scroll down and select Generic SPA Application.
4. On the Setup page, check the Authorization Code grant type. This SDK supports only the authorization code flow with PKCE.
5. If you intend to use refresh tokens, check the Refresh Token (OIDC) grant type. Failing to do so will cause errors if you attempt to use refresh tokens.
6. Add all URIs that you may redirect to after a successful login or logout. Failing to do so will cause errors if you attempt to redirect to a different URI.
7. Make any other changes necessary for your application, then submit your changes.

Make note of your application's Client ID and Issuer URL (typically https://{yourIdaasDomain}.region.trustedauth.com/api/oidc). These will be required to configure the SDK.

Content Security Policy (CSP)

The IDaaS Auth SDK will send API requests to your IDaaS tenant. You will need to ensure the Content Security Policy of your web application is updated to include your IDaaS tenant hostname as an allowed connection source. For more information regarding CSP, see the MDN Content Security Policy documentation.

The following must be set in your Content Security Policy for the SDK to work. Replace entrust.us.trustedauth.com with your IDaaS tenant hostname.

connect-src entrust.us.trustedauth.com

Installation

npm install @entrustcorp/idaas-auth-js

Optional dependency for face biometrics:

npm install onfido-sdk-ui

Quickstart

import { IdaasClient } from "@entrustcorp/idaas-auth-js";

const idaas = new IdaasClient({
  issuerUrl: "https://example.us.trustedauth.com/api/oidc",
  clientId: "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  storageType: "localstorage", // Optional, defaults to "memory"
  // Optional: restrict ID token signature algorithms accepted during OIDC validation
  allowedIdTokenSigningAlgorithms: ["RS256"]
});

// Popup flow (auto stores tokens)
await idaas.oidc.login({ popup: true });

// Use tokens
const accessToken = await idaas.getAccessToken();

When allowedIdTokenSigningAlgorithms is provided, OIDC login/token exchange validates the ID token signature algorithm against this allowlist and rejects tokens signed with algorithms outside the list. The configured value must match the ID token signing algorithm(s) defined in your IDaaS SPA application settings.

See the Quickstart guide for configuration options, redirect flows, error handling, and self-hosted examples.

DPoP protected resource requests

If your API validates DPoP proofs, request a DPoP-bound access token and use getDpopHeaders() when calling the protected resource.

const accessToken = await idaas.getAccessToken({
  audience: "https://api.example.com",
  scope: "accounts:read",
  dpop: { alg: "ES256" }
});

if (!accessToken) {
  throw new Error("No access token available");
}

const headers = await idaas.getDpopHeaders({
  method: "GET",
  uri: "https://api.example.com/accounts",
  accessToken
});

await fetch("https://api.example.com/accounts", { headers });

The protected resource must verify the access token and DPoP proof, including the token cnf.jkt binding. See the DPoP guide for details.

Documentation

Guides

• Overview
• Quickstart
• Choosing an Authentication Approach
• OIDC Guide
• RBA Guide
• Convenience Auth Guide
• Step-Up Authentication Guide
• DPoP Protected Resource Requests
• AWS API Gateway Integration
• JWT IDaaS Grant Type
• Self-Hosted UI Examples
• Troubleshooting

API Reference

• Complete API Documentation - Auto-generated from TypeScript source code
  • IdaasClient - Main client class
  • OidcClient - Hosted authentication methods
  • RbaClient - Risk-based authentication methods
  • AuthClient - Convenience authentication methods
• Manual Reference - Hand-crafted reference guide

License

See LICENSE for details.