OAuthPluginConfig

Defined in: types.ts:48

Properties

callbackUrl?

optional callbackUrl?: string

Defined in: types.ts:52

Path registered as the OAuth callback route. Default: /auth/{providerKey}/callback

---

clientId

clientId: string

Defined in: types.ts:49

---

clientSecret

clientSecret: string

Defined in: types.ts:50

---

entity?

optional entity?: string

Defined in: types.ts:55

Service used to find or create users. Default: 'users'

---

entityIdField?

optional entityIdField?: string

Defined in: types.ts:57

Field matched against the provider’s user ID. Default: '{providerKey}Id'

---

redirectUrl?

optional redirectUrl?: string

Defined in: types.ts:74

Frontend URL to redirect to once the OAuth dance completes, for browser-based flows where /auth/{providerKey} is opened via full-page navigation (an <a href>, not fetch) and a frontend page needs to pick up the resulting session. When set:

• success redirects to ${redirectUrl}#accessToken=...&refreshToken=...
• failure redirects to ${redirectUrl}#error=... Tokens go in the URL fragment, never the query string, so they aren’t sent to the server or logged. Omit to get the original behavior: a JSON { accessToken, refreshToken, user } body on success, or a thrown error passed to next() on failure.

---

scope?

optional scope?: string[]

Defined in: types.ts:53

---

stateStore?

optional stateStore?: OAuthStateStore

Defined in: types.ts:63

Store for pending OAuth state (CSRF token + PKCE verifier). Defaults to an in-process in-memory store — multi-instance deployments (e.g. Cloud Run) must inject a shared implementation (Redis or similar) so the callback can land on any instance.