@shoojs/auth

Framework-agnostic Shoo auth client for browser apps.

Install

npm install @shoojs/auth

Usage (Vanilla)

import { createShooAuth } from "@shoojs/auth";

const auth = createShooAuth({
  shooBaseUrl: "https://shoo.dev",
  callbackPath: "/auth/callback"
});

// Start login
await auth.startSignIn();

// Safe to run on every page load
await auth.handleCallback();

// Read identity
const identity = auth.getIdentity();
console.log(identity.pairwiseSub);

// Explicit revocation/session check
const session = await auth.checkSession();
if (session.status === "login_required") {
  auth.clearIdentity();
}

// Optional automatic monitor (default 60s)
const monitor = auth.startSessionMonitor({
  intervalMs: 60_000,
  onLoginRequired: () => {
    auth.clearIdentity();
  }
});

// Later: monitor.stop();

Notes

• @shoojs/auth is browser-only.
• Browser token exchange does not accept clientSecret; use a server-side exchange for confidential clients.
• checkSession() returns active, login_required, or unsupported (for older Shoo servers without /session/check).