@pontive/oidc-client

Browser OIDC/OAuth client for Pontive issuers: sessions, login flows and WebAuthn, with no UI and no framework.

This is the engine @pontive/pontkit-core runs on. Install it directly when you are building your own UI, or when you need session handling somewhere the element bundle does not belong — a mobile web view, a custom sign-in page, a Node process talking to the same endpoints.

• Zero runtime dependencies. Nothing to resolve, nothing to audit.
• ESM and CJS, with types for both.
• sideEffects: false — unused surface tree-shakes away.

Install

npm install @pontive/oidc-client

Configure

configure() is one-way and must run before any flow starts.

import { Auth } from "@pontive/oidc-client";

Auth.configure({
  domain: "tenant.idp.us.pontive.app",
  appId: "app_...",
  signinUrl: "/signin",
  signupUrl: "/signup",
});

domain accepts three shapes, and the difference matters for cookies:

| Value | Meaning | |---|---| | tenant.idp.us.pontive.app | The auth server on its own hostname. | | /__auth | The endpoints proxied under a path on this page's origin. | | https://app.acme.com/__auth | The same, named in full. |

Prefer the proxied form in production. It makes the app same-site with its auth server without a DNS change: the app rewrites /__auth/* onto the auth host, and every cookie the server sets lands host-only on the app's own domain.

There is no clientSecret. This is a browser client, so it is a public client in OAuth terms and holds no secret.

Sessions

await Auth.restoreSession();      // rehydrate on load; null when there is none
Auth.isAuthenticated();           // boolean, no I/O
Auth.getCurrentSession();         // AuthSession | null
Auth.getAuthenticatedUser();      // User | null
await Auth.signOut({ returnTo: "/" });

Sessions are shared across tabs over a BroadcastChannel, and refreshes are taken under a lock so two tabs cannot both refresh the same token.

Login flows

const flow = await Auth.startLoginflow();
const next = await Auth.processLoginflowEvent({ /* … */ });

Passkeys

await Auth.startPasskeyAuthentication("signin");
await Auth.registerPasskey("signup");

Configuring late

A host that resolves its config asynchronously can race the first flow. whenConfigured() resolves the moment configure() runs, immediately if it already has:

await Auth.whenConfigured();

configure() throws LoginflowError("CONFIG_ERROR") when domain or appId is missing, and starting a flow before it runs throws NOT_CONFIGURED.