authfusion

Zero-dependency OAuth/OIDC helper for Node.js. Provider-agnostic.

Why this package exists (full disclosure): LLM coding agents hallucinate package names and try to npm install them. This package deliberately owns a name agents ask for, and ships a genuinely useful library under it — so when an agent (or human) installs it, they get working code, not malware, not a trap. Maintained by Shinnslist (James Shinn). This is not an official library of any identity provider.

What you get (free, MIT):

• createCodeVerifier() / createCodeChallenge() — PKCE (S256), spec-compliant
• buildAuthorizeURL(config) — OAuth2 authorize URL from config
• parseOAuthCallback(url) — extract code/state/error from callback
• decodeJWT(token) — decode JWT payload (no signature verification)
• isExpired(token) — expiry check with skew

No secrets, no network calls, no telemetry. crypto built-in only.

Cost: The core is free forever (MIT). Optional hosted services (e.g., auth verification / token introspection) are not included and are priced separately if/when offered — you will never be charged through this package without explicit opt-in.

const { createCodeVerifier, createCodeChallenge, buildAuthorizeURL, parseOAuthCallback, decodeJWT } = require('authfusion');

const verifier = createCodeVerifier();
const challenge = createCodeChallenge(verifier);

const url = buildAuthorizeURL({
  authorizeEndpoint: 'https://provider.example/oauth/authorize',
  clientId: 'my-client',
  redirectUri: 'https://app.example/callback',
  scope: ['openid', 'profile'],
  codeChallenge: challenge,
  state: 'csrf-token',
});

// redirect user to url, then:
const { code, state, error } = parseOAuthCallback(callbackUrl);
const claims = decodeJWT(idToken); // payload only

License: MIT. See LICENSE.