@zezosoft/zezo-oauth-react-native

Zezo OAuth 2.0 / OpenID Connect SDK for React Native and Expo.

Features

• Authorization Code + PKCE (S256)
• System browser authentication via expo-web-browser
• Deep-link callback parsing (query string or hash)
• Expo SecureStore token storage
• Refresh token support
• Logout / token revocation
• UserInfo
• TypeScript

Install

npx expo install expo-web-browser expo-secure-store
npm install @zezosoft/zezo-oauth-react-native

expo-auth-session is not required. This SDK opens the system browser with expo-web-browser and parses the redirect URL itself.

Mobile client

Create a separate public Zezo client for the mobile app.

Client: TIE Mobile
Client ID: <TIE_MOBILE_CLIENT_ID>
Client type: public
Redirect URI: tie://oauth/callback
Scopes: openid profile email
Issuer: https://api-v1.zezo.in

Never put a client secret in React Native.

Deep linking

Expo:

{
  "expo": {
    "scheme": "tie"
  }
}

Then use:

tie://oauth/callback

The exact redirect URI must be registered in Zezo.

Usage

import { ZezoAuth } from "@zezosoft/zezo-oauth-react-native";

const zezo = new ZezoAuth({
  clientId: process.env.EXPO_PUBLIC_ZEZO_CLIENT_ID!,
  redirectUri: "tie://oauth/callback",
  scopes: ["openid", "profile", "email"],
  storageKeyPrefix: "zezo_oauth",
});

scopes defaults to ["openid", "profile", "email"]. storageKeyPrefix defaults to "zezo_oauth" (tokens are stored as <prefix>_tokens in SecureStore).

Login

const result = await zezo.login();

console.log(result.accessToken);
console.log(result.refreshToken);
console.log(result.idToken);
console.log(result.user);

The SDK opens the system browser, so an existing Zezo browser session can be reused. After redirect, it validates state, exchanges the authorization code with the PKCE verifier, stores tokens in SecureStore, and attempts to load UserInfo.

Tokens

const tokens = await zezo.getTokens();
const accessToken = await zezo.getAccessToken();

User

const user = await zezo.getUserInfo();

Refresh

const tokens = await zezo.refreshToken();

Logout

await zezo.logout();

Logout revokes the access token when possible, then clears SecureStore.

Authentication state

const authenticated = await zezo.isAuthenticated();

This is true when tokens are present in SecureStore. It does not inspect expiry.

React Native example

import React from "react";
import { Button, View } from "react-native";
import { ZezoAuth } from "@zezosoft/zezo-oauth-react-native";

const zezo = new ZezoAuth({
  clientId: "YOUR_TIE_MOBILE_CLIENT_ID",
  redirectUri: "tie://oauth/callback",
  scopes: ["openid", "profile", "email"],
});

export default function LoginScreen() {
  const login = async () => {
    try {
      const result = await zezo.login();
      console.log("User:", result.user);
    } catch (error) {
      console.error(error);
    }
  };

  return (
    <View>
      <Button title="Continue with Zezo" onPress={login} />
    </View>
  );
}

OAuth flow

React Native
     |
     | Authorization Code + PKCE
     v
https://api-v1.zezo.in/oauth/authorize
     |
     | redirect with code
     v
tie://oauth/callback
     |
     | code + verifier
     v
https://api-v1.zezo.in/oauth/token

The mobile app never contains a client secret.

TIE recommendation

For TIE:

TIE Mobile
   |
   | Zezo OAuth + PKCE
   v
Zezo
   |
   | Zezo identity/token
   v
TIE Backend
   |
   | TIE JWT/session
   v
TIE Mobile

Keep any server-side client secret on the TIE backend only.

Runtime requirement

PKCE requires Web Crypto:

globalThis.crypto.getRandomValues;
globalThis.crypto.subtle.digest;

Use a current Expo / React Native runtime that provides Web Crypto.

Important security notes

• Do not use a WebView for OAuth.
• Do not ship clientSecret in the mobile app.
• Do not store tokens in AsyncStorage.
• Use an exact registered redirect URI.
• Prefer short-lived access tokens and refresh-token rotation on the server.
• Treat the Zezo access token as a Zezo credential; your TIE backend may issue a separate TIE JWT if that is your application architecture.

API

new ZezoAuth({
  clientId: string;
  redirectUri: string;
  scopes?: string[];
  storageKeyPrefix?: string;
})

login()
getTokens()
getAccessToken()
getUserInfo(accessToken?)
refreshToken()
logout()
isAuthenticated()

Also exported:

ZEZO_ISSUER;
AUTHORIZE_ENDPOINT;
TOKEN_ENDPOINT;
USERINFO_ENDPOINT;
REVOKE_ENDPOINT;

Issuer is fixed to https://api-v1.zezo.in and is not configurable.

License

MIT