Node.js OpenID Connect example with openid-client

Sign-in with Dazr Identity: free OpenID Connect, hosted in the EU, with passkeys, email codes and Google or Microsoft accounts behind one button.

You need three values from the developer console: the client ID, the client secret (web server apps only) and the redirect URI you registered. Everything else comes from the discovery document at https://identity.dazr.eu/.well-known/openid-configuration.

Node.js (openid-client)

openid-client (version 6) reads the discovery document and checks PKCE, state, nonce and the ID token for you.

import * as client from 'openid-client';

const config = await client.discovery(
  new URL('https://identity.dazr.eu'),
  process.env.DAZR_CLIENT_ID,
  process.env.DAZR_CLIENT_SECRET, // public client: pass undefined here and client.None() as the 4th argument
);
const redirect_uri = 'https://app.example.eu/auth/dazr/callback';

// 1. Start: keep the three random values in the user's session.
export async function start(session) {
  session.verifier = client.randomPKCECodeVerifier();
  session.state = client.randomState();
  session.nonce = client.randomNonce();
  return client.buildAuthorizationUrl(config, {
    redirect_uri,
    scope: 'openid profile email',
    code_challenge: await client.calculatePKCECodeChallenge(session.verifier),
    code_challenge_method: 'S256',
    state: session.state,
    nonce: session.nonce,
  });
}

// 2. Callback: pass the full callback URL (a URL object).
export async function callback(session, currentUrl) {
  const tokens = await client.authorizationCodeGrant(config, currentUrl, {
    pkceCodeVerifier: session.verifier,
    expectedState: session.state,
    expectedNonce: session.nonce,
  });
  const claims = tokens.claims(); // sub, email, name
  return { sub: claims.sub, email: claims.email, name: claims.name };
}

More for developers

Developer docsAll integration guidesAny OpenID Connect libraryPricing