# @openid4vc/oauth2

> OAuth 2.0 Authorization Framework implementation, including extension specifications

Latest version **0.5.6** (published 2026-09-16) · Apache-2.0 license · 0 weekly downloads

## Install

```sh
npm install @openid4vc/oauth2
pnpm add @openid4vc/oauth2
yarn add @openid4vc/oauth2
bun add @openid4vc/oauth2
```

## Health

**Score 70/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.

Warnings: low downloads; pre 1.0.

## Facts

| | |
|---|---|
| Version | 0.5.6 |
| Published | 2026-09-16 |
| First published | 2025-01-09 |
| Weekly downloads | 0 |
| License | Apache-2.0 |
| TypeScript types | bundled |
| Module format | ESM + CommonJS |
| Dependencies | 2 |
| Unpacked size | 634.5 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 29 |
| Author | Animo Solutions |
| Maintainers | timoglastra, openwalletfoundation |
| Keywords | oauth2, dpop, pkce, par, jar, openid4vc |

## Links

- npm: https://www.npmjs.com/package/@openid4vc/oauth2
- Repository: https://github.com/openwallet-foundation-labs/identity-common-ts
- Homepage: https://github.com/openwallet-foundation-labs/identity-common-ts/tree/main/packages/oauth2
- Issues: https://github.com/openwallet-foundation-labs/identity-common-ts/issues
- npm.io page: https://npm.io/package/@openid4vc/oauth2

## Dependencies (2)

- [zod](https://npm.io/package/zod.md) ^4.6.5
- [@openid4vc/utils](https://npm.io/package/@openid4vc/utils.md) ^0.5.6

## Alternatives

- [babylon](https://npm.io/package/babylon.md) — 5.1M weekly downloads
- [csscolorparser](https://npm.io/package/csscolorparser.md) — 3.7M weekly downloads
- [expr-eval-fork](https://npm.io/package/expr-eval-fork.md) — 1.5M weekly downloads
- [@leeoniya/ufuzzy](https://npm.io/package/@leeoniya/ufuzzy.md) — 247.7K weekly downloads
- [xml-parser](https://npm.io/package/xml-parser.md) — 78.4K weekly downloads

## Recent versions

- 0.5.6 (latest) — 2026-09-16
- 0.5.6-alpha-20260922123038 (alpha) — 2026-09-22
- 0.5.7-alpha-20260922110620 — 2026-09-22
- 0.5.7-alpha-20260921121727 — 2026-09-21
- 0.5.7-alpha-20260920163617 — 2026-09-20
- 0.5.7-alpha-20260920143658 — 2026-09-20
- 0.5.7-alpha-20260920133054 — 2026-09-20
- 0.5.7-alpha-20260919211014 — 2026-09-19
- 0.5.7-alpha-20260919112629 — 2026-09-19
- 0.5.7-alpha-20260919100859 — 2026-09-19
- 0.5.7-alpha-20260919094428 — 2026-09-19
- 0.5.7-alpha-20260918081040 — 2026-09-18
- 0.5.7-alpha-20260918080827 — 2026-09-18
- 0.5.7-alpha-20260917172451 — 2026-09-17
- 0.5.7-alpha-20260917125442 — 2026-09-17
- … 249 more at https://npm.io/package/@openid4vc/oauth2/versions

## README

# @openid4vc/oauth2

[![npm version](https://img.shields.io/npm/v/@openid4vc/oauth2)](https://npmjs.com/package/@openid4vc/oauth2)
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/main/LICENSE)

An implementation of the [OAuth 2.0 Authorization Framework](https://datatracker.ietf.org/doc/html/rfc6749), including extension specifications:

- [RFC 9126 - OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/html/rfc9126)
- [OAuth 2.0 for First-Party Applications - Draft 0](https://www.ietf.org/archive/id/draft-ietf-oauth-first-party-apps-00.html)
- [RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients](https://datatracker.ietf.org/doc/html/rfc7636)
- [RFC 9449 - OAuth 2.0 Demonstrating Proof of Possession (DPoP)](https://datatracker.ietf.org/doc/html/rfc9449)
- [RFC 7662 - OAuth 2.0 Token Introspection](https://datatracker.ietf.org/doc/html/rfc7662)
- [RFC 9068 JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens](https://datatracker.ietf.org/doc/html/rfc9068)
- [RFC 8707 - Resource Indicators for OAuth 2.0](https://www.rfc-editor.org/rfc/rfc8707.html)
- [OAuth 2.0 Attestation-Based Client Authentication](https://www.ietf.org/archive/id/draft-ietf-oauth-attestation-based-client-auth-09.html)
- [RFC 9207 - OAuth 2.0 Authorization Server Issuer Identification](https://www.rfc-editor.org/rfc/rfc9207.html)

This package was previously developed in the [oid4vc-ts](https://github.com/openwallet-foundation-labs/oid4vc-ts) repository. The `@openid4vc/*` packages are versioned together, separately from the other packages in this repository.

## Installation

```bash
# Using npm
npm install @openid4vc/oauth2

# Using pnpm
pnpm add @openid4vc/oauth2

# Using yarn
yarn add @openid4vc/oauth2
```

## Usage

```ts
import { Oauth2AuthorizationServer, Oauth2Client, Oauth2ResourceServer } from '@openid4vc/oauth2'
```

## Dependencies

- [@openid4vc/utils](https://www.npmjs.com/package/@openid4vc/utils)
- [zod](https://www.npmjs.com/package/zod)

## Platform Support

This library is **platform agnostic** and works in:

- ✅ Node.js (>=22)
- ✅ Browsers (modern browsers with ES2020 support)
- ✅ React Native

The environment must provide an implementation of `URL` and `URLSearchParams`. Platform-specific functionality such as hashing, generating random bytes and signing is provided through callbacks. If no global `fetch` is available in your environment, it also needs to be provided through the callbacks.

## Contributing

See the [Contributing Guide](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/main/CONTRIBUTING.md) for details on how to contribute to this project.

## License

This project is licensed under the [Apache License Version 2.0](https://github.com/openwallet-foundation-labs/identity-common-ts/blob/main/LICENSE) (Apache-2.0).

## Credits

This library was initially created by [Animo](https://animo.id) as part of the [SPRIN-D EUDI Wallet Prototypes Funke](https://www.sprind.org/en/impulses/challenges/eudi-wallet-prototypes).

---
_Source: https://npm.io/package/@openid4vc/oauth2 · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._