artifacts-builder

# TypeScript OAuth2.0 Server

[](https://jsr.io/@jmondi/oauth2-server)

[](https://www.npmjs.com/package/@jmondi/oauth2-server)

[](https://github.com/jasonraimondi/ts-oauth2-server)

[](https://codecov.io/gh/jasonraimondi/ts-oauth2-server)

[](https://www.npmjs.com/package/@jmondi/oauth2-server)

@jmondi/oauth2-server is a standards compliant implementation of an OAuth 2.0 authorization server written in TypeScript.

Requires node >= 18. [Read the docs](https://tsoauth2server.com/)

The following RFCs are implemented:

• [RFC6749 "OAuth 2.0"](https://tools.ietf.org/html/rfc6749)
• [RFC6750 "The OAuth 2.0 Authorization Framework: Bearer Token Usage"](https://tools.ietf.org/html/rfc6750)
• [RFC7009 "OAuth 2.0 Token Revocation"](https://tools.ietf.org/html/rfc7009)
• [RFC7519 "JSON Web Token (JWT)"](https://tools.ietf.org/html/rfc7519)
• [RFC7636 "Proof Key for Code Exchange by OAuth Public Clients"](https://tools.ietf.org/html/rfc7636)
• [RFC7662 "OAuth 2.0 Token Introspection"](https://tools.ietf.org/html/rfc7662)
• [RFC8693 "OAuth 2.0 Token Exchange"](https://datatracker.ietf.org/doc/html/rfc8693)

Out of the box it supports the following grants:

• [Authorization code grant](https://tsoauth2server.com/docs/grants/authorization_code)
• [Client credentials grant](https://tsoauth2server.com/docs/grants/client_credentials)
• [Refresh grant](https://tsoauth2server.com/docs/grants/refresh_token)
• [Implicit grant](https://tsoauth2server.com/docs/grants/implicit) // not recommended
• [Resource owner password credentials grant](https://tsoauth2server.com/docs/grants/password) // not recommended

Framework support:

The included adapters are just helper functions, any framework should be supported. Take a look at the adapter implementations to learn how you can create custom adapters for your favorite tool!

• [VanillaJS](https://tsoauth2server.com/docs/adapters/vanilla)
• [Express](https://tsoauth2server.com/docs/adapters/express)
• [Fastify](https://tsoauth2server.com/docs/adapters/fastify).

Usage

A example using client credentials grant

```ts

const authorizationServer = new AuthorizationServer(

clientRepository,

accessTokenRepository,

scopeRepository,

"secret-key",

);

authorizationServer.enableGrantType("client_credentials");

app.post("/token", async (req: Express.Request, res: Express.Response) => {

try {

const oauthResponse = await authorizationServer.respondToAccessTokenRequest(req);

return handleExpressResponse(res, oauthResponse);

} catch (e) {

handleExpressError(e, res);

}

});

app.post("/token/revoke", async (req: Express.Request, res: Express.Response) => {

try {

const oauthResponse = await authorizationServer.revoke(req);

return handleExpressResponse(res, oauthResponse);

} catch (e) {

handleExpressError(e, res);

}

});

```

Example implementations:

• [Simple](./example)
• [Advanced](https://github.com/jasonraimondi/ts-oauth2-server-example)

Security

| Version | Latest Version | Security Updates |

|-----------------|----------------|------------------|

| [4.x][version4] | :tada: | :tada: |

| [3.x][version3] | :tada: | :tada: |

| [2.x][version2] | | :tada: |

[version4]: https://github.com/jasonraimondi/ts-oauth2-server/tree/main

[version3]: https://github.com/jasonraimondi/ts-oauth2-server/tree/3.x

[version2]: https://github.com/jasonraimondi/ts-oauth2-server/tree/2.x