Logto Connector: OIDC with PKCE

A Logto social connector that adds optional PKCE (Proof Key for Code Exchange, RFC 7636) support to the standard OpenID Connect authorization code flow.

It is a drop-in fork of @logto/connector-oidc v1.7.1 with one extra config flag — enablePkce — and a separate connector factory id (oidc-pkce) so it can coexist with the upstream OIDC connector.

When you need this

The stock @logto/connector-oidc does not emit code_challenge / code_verifier. Identity providers that require PKCE on the authorization code flow will reject Logto's authorization request with:

PKCE flow requires both code_challenge and code_challenge_method

Providers known to require this:

• Supabase Auth
• Logto-hosted IdPs configured for public clients
• QuickPJ / other providers built on top of public-client OAuth libraries

Installation

npm install @quickguidehealth/connector-logto-oidc-pkce

For Logto running in Kubernetes, install via the chart's customConnectors.packages array (matches the existing pattern used for @quickguidehealth/connector-logto-novu):

logto:
  customConnectors:
    enabled: true
    packages:
      - "@quickguidehealth/[email protected]"

Configuration

Same shape as the upstream @logto/connector-oidc config, plus a single enablePkce flag:

{
  "authorizationEndpoint": "https://example.com/authorize",
  "tokenEndpoint": "https://example.com/token",
  "clientId": "your-client-id",
  "clientSecret": "your-client-secret",
  "tokenEndpointAuthMethod": "client_secret_basic",
  "responseType": "code",
  "grantType": "authorization_code",
  "scope": "openid profile email",
  "enablePkce": true,
  "idTokenVerificationConfig": {
    "jwksUri": "https://example.com/.well-known/jwks.json"
  }
}

Set enablePkce: true to opt into PKCE. With the flag absent or false the connector behaves identically to the upstream @logto/connector-oidc.

How PKCE works here

When enablePkce is true:

1. On /authorize, the connector generates a fresh code_verifier (32 random bytes, base64url-encoded — 256 bits of entropy, well above the RFC 7636 minimum).
2. It computes code_challenge = BASE64URL(SHA256(code_verifier)) and appends code_challenge and code_challenge_method=S256 to the authorization URL.
3. The code_verifier is persisted in the connector session storage.
4. On /token, the connector retrieves the stored code_verifier and includes it in the token request body alongside the authorization code.
5. The IdP recomputes SHA256(code_verifier) and rejects the token request if it doesn't match the stored code_challenge — preventing authorization-code interception attacks.

Only the S256 method is implemented. plain is intentionally not supported.

Coexistence with @logto/connector-oidc

The connector is registered with id: 'oidc-pkce', distinct from upstream's id: 'oidc', so both connectors can be installed at the same time. In the Logto admin console you'll see two factories side-by-side:

• OIDC — upstream, no PKCE
• OIDC (with PKCE) — this package

Pick the one your provider needs.

Compatibility

• Logto 1.38.0 or later (ships @logto/connector-kit ^5.0.0).
• Node.js 22.x or later.

License

MPL-2.0, inherited from upstream @logto/connector-oidc. The modified files (src/index.ts, src/utils.ts, src/types.ts, src/constant.ts) remain MPL-2.0 per the file-level copyleft of the license.

Attribution

Forked from @logto/connector-oidc v1.7.1 (Silverhand Inc.). PKCE helpers adapted from @logto/connector-x.