# @byu-oit-sdk/credential-provider

> Chains multiple credential providers together

Latest version **0.20.0** (published 2026-04-29) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @byu-oit-sdk/credential-provider
pnpm add @byu-oit-sdk/credential-provider
yarn add @byu-oit-sdk/credential-provider
bun add @byu-oit-sdk/credential-provider
```

## Health

**Score 60/100 (C)** — status: active.

Positive: has types; esm support; no vulnerabilities; high quality score.

Warnings: low downloads; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.20.0 |
| Published | 2026-04-29 |
| First published | 2022-11-10 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Node | >=22 |
| Dependencies | 3 |
| Unpacked size | 546.8 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Author | Spencer Tuft |
| Maintainers | stuft2, byu-oit-bot |

## Links

- npm: https://www.npmjs.com/package/@byu-oit-sdk/credential-provider
- Repository: https://github.com/byu-oit-sdk/javascript
- Homepage: https://github.com/byu-oit-sdk/javascript#readme
- Issues: https://github.com/byu-oit-sdk/javascript/issues
- npm.io page: https://npm.io/package/@byu-oit-sdk/credential-provider

## Dependencies (3)

- [tslib](https://npm.io/package/tslib.md) ^2.5.0
- [uncrypto](https://npm.io/package/uncrypto.md) ^0.1.2
- [camel-case](https://npm.io/package/camel-case.md) ^4.1.2

## Recent versions

- 0.20.0 (latest) — 2026-04-29
- 0.19.0 — 2026-04-06
- 0.18.0 — 2025-07-22
- 0.17.1 — 2025-05-01
- 0.17.0 — 2025-04-01
- 0.16.2 — 2025-03-18
- 0.16.1 — 2025-03-12
- 0.16.0 — 2025-02-20
- 0.15.1 — 2025-02-19
- 0.15.0 — 2025-01-22
- 0.14.3 — 2025-01-21
- 0.14.2 — 2024-11-14
- 0.14.1 — 2024-10-29
- 0.14.0 — 2024-10-02
- 0.13.2 — 2024-07-27
- … 45 more at https://npm.io/package/@byu-oit-sdk/credential-provider/versions

## README

# @byu-oit-sdk/credential-provider

A Credential Provider is a class that exposes a `getAccessToken` function. It is configured according to
an [OpenId Configuration](#openid-configuration).

**Supported providers:**

- [Client Credentials](#md:client-credentials-provider)
- [Authorization Code](#md:authorization-code-provider)
- [Api Key](#md:api-key-provider)
- [Chained Credential](#md:chained-credential-provider)

> Note that any of the credential providers will attempt load configuration options from environment variables with
> the `BYU_OIT_` prefix if they are not passed in the constructor.
> 
> For example, `process.env.BYU_OIT_CLIENT_ID` and `process.env.BYU_OIT_CLIENT_SECRET` can be set instead of passing `clientId`
> and `clientSecret` into the options object for the ClientCredentialsProvider.

## Client Credentials Provider

The ClientCredentialsProvider facilitates fetching an access token using the client credentials grant type.

```typescript
import {ClientCredentialsProvider} from '@byu-oit-sdk/credential-provider'

const provider = new ClientCredentialsProvider({
    clientId: 'super-id',
    clientSecret: 'super-secret',
    discoveryEndpoint: 'https://api.byu.edu/.well-known/openid-configuration',
    scope: 'my-scope', // Optional
    type: 'Basic ' // Optional
})

const token = await provider.getAccessToken()
```

Like the OpenIdConfiguration class, there is a `from` constructor for validating unknown input.

```typescript
import {ClientCredentialsProvider} from '@byu-oit-sdk/credential-provider'
import {join} from 'node:fs'
import {readFileSync} from 'node:path'

const config = readFileSync(join(__dirname, './config.json'))
const provider = ClientCredentialsProvider.from(config)
```

You may also load your configuration from environment variables. This can be done on any credential provider except the
abstract or base classes (i.e. CredentialProvider, TokenProvider, OauthCredentialProvider).

```typescript
import {ClientCredentialsProvider} from '@byu-oit-sdk/credential-provider'
const provider = ClientCredentialsProvider.fromEnv() // defaults to 'BYU_OIT_' prefix
```

Optionally, you can pass in a prefix to use instead of the default `BYU_OIT_` prefix.

```typescript
import {ClientCredentialsProvider} from '@byu-oit-sdk/credential-provider'

const provider = ClientCredentialsProvider.fromEnv('MY_PREFIX_')
```

## Authorization Code Provider

The AuthorizationCodeProvider facilitates fetching an access token using the authorization code grant type. The
Authorization Code grant type requires a code exchange to get the token. You must implement the flow to get the code
and exchange it for a token. To help implement the flow, the AuthorizationCodeProvider also exposes a few functions
for each step.

1. Instantiate the provider.
    ```typescript
    import {AuthorizationCodeProvider} from '@byu-oit-sdk/credential-provider'
    
    const provider = new AuthorizationCodeProvider({
        clientId: 'super-id',
        clientSecret: 'super-secret', // OPTIONAL
        redirectUri: 'http://localhost:8080/callback',
        discoveryEndpoint: 'https://api.byu.edu/.well-known/openid-configuration'
    })
    ```

2. Redirect a caller to the authorization endpoint formatted by the provider. Optionally pass generate and pass
   in a code verifier for Proof Key Code Exchange (PKCE). The generator accepts a length parameter and will generate
   a code of that length. The default length is 32. The state can also be used to pass along the state of the app
   before the redirect occurred. The state will be checked for sameness in the next step of the authorization flow.

    ```typescript
    import {generateCodeVerifier} from '@byu-oit-sdk/credential-provider'
   
    const state = 'some_state'
    const codeVerifier = generateCodeVerifier(48)
    const uri = provider.getAuthorizationUri({ codeVerifier, state })
    ```

3. Handle the OAuth callback to your application and extract the authorization code from the url. If no state is
   provided in the previous step but the authorization issuer provides one, it must be ignored. Otherwise, an error will
   be thrown.

    ```typescript
    const authCode = provider.getAuthCodeFromRedirect(urlFromRedirect, state)
    ```

4. Exchange the code for an access token. If you're using Proof Key Code Exchange (PKCE), you must pass in the code
   verifier.
   ```typescript
   const token = provider.getTokenFromAuthCode(authCode, codeVerifier)
   ```

## API Key Provider

The ApiKeyProvider facilitates fetching resources using API Key authentication. We do not recommend using this
credential provider but realize that some authorization servers only support this authorization scheme.

```ts
import {ApiKeyProvider} from '@byu-oit-sdk/credential-provider'

const provider = new ApiKeyProvider({
    apiKey: 'my-api-key'
})

const apiKey = await provider.getAccessToken()
```

## Chained Credential Provider

The ChainedCredentialProvider is a function (not a constructor) that facilitates the automatic instantiation of one of
credential providers from environment variables with the `BYU_OIT_` prefix. The first provider to successfully
instantiate is the provider returned. The order of the provider instantiation is based on which provider is 
anticipated to be most used:

1. Client Credential Provider
2. Authorization Code Provider
3. ApiKey Provider Provider

## OpenId Configuration

An OpenIdConfiguration object may be loaded from a remote location by passing a URI into the `load` constructor.

```typescript
import {OpenIdConfiguration} from "@byu-oit-sdk/credential-provider";

const openId = await OpenIdConfiguration.load('https://api.byu.edu/.well-known/openid-configuration')
```

It may also be configured synchronously from a JSON file with the constructor. It is recommended that you use the `from`
constructor which will validate the input to ensure correctness.

```typescript
import {OpenIdConfiguration} from '@byu-oit-sdk/credential-provider'
import config from './openid-configuration.json'

const openId = OpenIdConfiguration.from(config)
```

---
_Source: https://npm.io/package/@byu-oit-sdk/credential-provider · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._