openauth

OAuth without the framework.

Minimal, typed OAuth 2.0 clients: authorization URL, code exchange, verified user profile - three calls, nothing more. Sessions, storage, and UI stay yours.

• Zero dependencies - Web Crypto API and fetch only. Runs on Deno, Node.js, and Bun.
• Per-provider packages - install @openauth/google, get Google. Nothing else.
• OIDC done right - id_token signature (JWKS), issuer, audience, and expiration verified out of the box.

Not another auth framework

If you want...	Use
A hosted identity service	Auth0, Clerk
A self-hosted auth server	OpenAuth (SST)
Framework middleware with sessions	Auth.js, Passport
Just the OAuth flow, verified profile included	openauth

Install

# Deno
deno add jsr:@denostack/openauth

# Node.js / Bun - one package per provider
npm install @openauth/google

Usage

Every provider follows the same 3-step flow:

import { GoogleOAuth } from "@denostack/openauth/google"; // npm: @openauth/google

const oauth = new GoogleOAuth({
  clientId: "your_client_id",
  clientSecret: "your_client_secret",
  redirectUri: "https://example.com/callback/google",
});

// 1. Generate the authorization URL and redirect the user
const url = await oauth.getAuthRequestUri({ state: "random_state" });

// 2. Exchange the authorization code for an access token
const token = await oauth.getAccessTokenResponse(code);

// 3. Fetch the user profile
const user = await oauth.getUserProfile(token.accessToken);
// => { id, name, email, emailVerified, picture, ... , raw }

For OIDC providers (e.g. Google), you can skip the extra HTTP request and extract the profile directly from the id_token:

const user = await oauth.getUserProfileFromIdToken(token.idToken);

The token's signature (via JWKS), issuer, audience, and expiration are all verified.

Providers

Provider	OIDC	Download
Apple	✓
Atlassian	not supported
Discord	not supported
Facebook	✓
Figma	not supported
GitHub	not supported
GitLab	✓
Google	✓
Kakao	✓
LINE	✓
LinkedIn	✓
Naver	not supported
Slack	✓

Click a provider to see its detailed usage guide. The OIDC column marks providers that support getUserProfileFromIdToken - verifying a signed id_token instead of calling the userinfo endpoint.

More providers are on the way - each one is verified against the real service before release.