@mowogames/auth-sdk

A tiny, dependency-free TypeScript client for the Mowo Auth OIDC server. Works in any modern browser, Node ≥ 18, the Edge runtime, and Bun.

npm install @mowogames/auth-sdk

Vanilla JS / TS

import { MowoAuthClient } from '@mowogames/auth-sdk';

const auth = new MowoAuthClient({
  issuer: 'https://login.example.com',
  realm: 'main',
  clientId: 'my-app',
  redirectUri: `${location.origin}/callback`,
  postLogoutRedirectUri: location.origin,
});

// On your /callback route:
if (location.pathname === '/callback') {
  await auth.handleCallback();
  history.replaceState(null, '', '/');
}

// Anywhere else:
if (!auth.isAuthenticated()) {
  await auth.signIn();
}

const user = await auth.getUser();
console.log(`Hello ${user.name}`);

auth.fetch(url, init) is a drop-in replacement for fetch that attaches the access token and transparently refreshes it before expiry.

const res = await auth.fetch('/api/whatever');

React

import { MowoAuthProvider, useMowoAuth } from '@mowogames/auth-sdk/react';

function App() {
  return (
    <MowoAuthProvider
      config={{
        issuer: 'https://login.example.com',
        clientId: 'my-app',
        redirectUri: `${window.location.origin}/callback`,
      }}
    >
      <Routes />
    </MowoAuthProvider>
  );
}

function Profile() {
  const { user, isLoading, signIn, signOut } = useMowoAuth();
  if (isLoading) return <p>…</p>;
  if (!user) return <button onClick={() => signIn()}>Sign in</button>;
  return (
    <>
      <p>Hi {user.name}</p>
      <button onClick={() => signOut()}>Sign out</button>
    </>
  );
}

The provider auto-handles the OIDC callback when the browser lands on callbackPath (default /callback) — you don't need a dedicated route, just make sure the path exists and renders something.

Configuration

| field | required | default | description | | ------------------------- | -------- | ---------------------- | ---------------------------------------- | | issuer | ✓ | — | Public origin of your Mowo Auth install. | | clientId | ✓ | — | Your registered OIDC client_id. | | redirectUri | ✓ | — | Where Mowo Auth redirects after sign-in. | | realm | | main | Realm slug. | | postLogoutRedirectUri | | — | Where to land after signOut(). | | scope | | openid profile email | Requested scopes. | | storage | | sessionStorage | Token store. See alternatives below. |

Token storage

By default tokens live in sessionStorage (cleared when the tab closes). Three built-in alternatives:

import {
  defaultStorage,        // sessionStorage; the default
  localStorageStorage,   // persists across tabs and restarts
  memoryStorage,         // in-memory; useful for SSR
} from '@mowogames/auth-sdk';

You can also supply your own — anything matching TokenStorage:

import type { TokenStorage } from '@mowogames/auth-sdk';
const myStorage: TokenStorage = { get, set, clear };

What this SDK does NOT do

• It does not validate ID tokens. OIDC says clients SHOULD; we follow the Auth0 / NextAuth convention of trusting userinfo instead. If you need real signature verification, do it server-side.
• It does not store tokens in httpOnly cookies. That's a server-side concern. If you want the BFF pattern, run a thin proxy in your backend and use the access token there.

License

MIT — see LICENSE.md.