payload-plugin-oidc-nx

OIDC plugin for Payload CMS 3.

Fork notice: This is a fork/rewrite of payload-plugin-oidc by Stratos Giouldasis, updated for Payload 3 compatibility. The original plugin supports Payload 2 only.

Features

• Sign in with any OIDC provider
• Sign in button on the Payload admin login page
• Automatic user creation on first login (optional)
• Session-based JWT auth (Payload 3)

Installation

npm install payload-plugin-oidc-nx

Usage

// payload.config.ts
import { buildConfig } from 'payload';
import { oidcPlugin } from 'payload-plugin-oidc-nx';

export default buildConfig({
  // ...
  plugins: [
    oidcPlugin({
      clientID: process.env.OIDC_CLIENT_ID,
      clientSecret: process.env.OIDC_CLIENT_SECRET,
      authorizationURL: `${process.env.OIDC_URI}/auth`,
      tokenURL: `${process.env.OIDC_URI}/token`,
      callbackURL: `${process.env.SERVER_URL}/api/oidc/callback`,
      scope: 'openid profile email',
      initPath: '/oidc/signin',
      callbackPath: '/oidc/callback',
      createUserIfNotFound: true,
      async userinfo(accessToken) {
        const res = await fetch(`${process.env.OIDC_URI}/userinfo`, {
          headers: { Authorization: `Bearer ${accessToken}` },
        });
        const user = await res.json();
        return {
          sub: user.sub,
          email: user.email,
          name: user.name,
        };
      },
      userCollection: {
        slug: 'users',
        searchKey: 'sub',
      },
    }),
  ],
});

Note: In Payload 3, custom endpoints are mounted under /api/. The callback URL registered with your OIDC provider must include this prefix (e.g. http://localhost:3000/api/oidc/callback).

E2E Testing

See e2e/README.md for a local test setup using Dex as an OIDC provider.

License

The MIT License (MIT). Please see License File for more information.