# @solid/access-token-verifier

> Verifies Solid OIDC access tokens via their webid claim, and thus asserts ownership of a WebID.

Latest version **2.1.2** (published 2026-08-27) · MIT license · 0 weekly downloads

## Install

```sh
npm install @solid/access-token-verifier
pnpm add @solid/access-token-verifier
yarn add @solid/access-token-verifier
bun add @solid/access-token-verifier
```

## Health

**Score 65/100 (B)** — status: active.

Positive: has types; no vulnerabilities; recently updated; high maintenance score; high quality score.

Warnings: low downloads; no esm support.

## Facts

| | |
|---|---|
| Version | 2.1.2 |
| Published | 2026-08-27 |
| First published | 2021-07-12 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 5 |
| Unpacked size | 225.3 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 4 |
| Maintainers | justinwb, kjetilk, joachimvh, jaxoncreed, inrupt_ci, nseydoux, megoth, michielbdejong, virginiabalseiro, timbl, bourgeoa, kkuffour, matthieubosquet, langsamu, precious.oritsedere, jeswr |
| Keywords | Solid, OIDC, Access Token, Token Verification, DPoP, Bearer, Token, OAuth |

## Links

- npm: https://www.npmjs.com/package/@solid/access-token-verifier
- Repository: https://github.com/solid/access-token-verifier
- Homepage: https://github.com/solid/access-token-verifier#readme
- Issues: https://github.com/solid/access-token-verifier/issues
- npm.io page: https://npm.io/package/@solid/access-token-verifier

## Dependencies (5)

- [n3](https://npm.io/package/n3.md) ^1.17.1
- [jose](https://npm.io/package/jose.md) ^5.1.3
- [lru-cache](https://npm.io/package/lru-cache.md) ^6.0.0
- [ts-guards](https://npm.io/package/ts-guards.md) ^0.5.1
- [node-fetch](https://npm.io/package/node-fetch.md) ^2.7.0

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 2.1.2 (latest) — 2026-08-27
- 2.1.1 — 2026-01-05
- 2.1.0 — 2024-01-05
- 2.0.5 — 2022-10-21
- 2.0.4 — 2022-10-16
- 2.0.3 — 2022-06-28
- 2.0.2 — 2022-06-28
- 2.0.0 — 2022-04-21
- 1.2.9 — 2022-04-21
- 1.2.8 — 2022-04-21
- 1.2.6 — 2022-04-21
- 1.2.5 — 2022-04-21
- 1.2.2 — 2022-03-28
- 1.2.1 — 2022-03-15
- 1.2.0 — 2022-02-12
- … 16 more at https://npm.io/package/@solid/access-token-verifier/versions

## README

# Solid OIDC Access Token Verifier

[![Project Solid](https://img.shields.io/badge/Project-Solid-7C4DFF.svg)](https://solidproject.org/)
[![Test workflow](https://github.com/solid/access-token-verifier/workflows/Unit%20Tests/badge.svg?branch=main)](https://github.com/solid/access-token-verifier/actions/workflows/test-unit.yml?query=workflow%3Atest+branch%3Amain)
[![npm package](https://img.shields.io/npm/v/@solid/access-token-verifier)](https://www.npmjs.com/package/@solid/access-token-verifier)

This library verifies Solid OIDC access tokens via their `webid` claim, and thus asserts ownership of a [WebID](https://www.w3.org/2005/Incubator/webid/spec/).

It conforms to the [Solid OIDC specification](https://solid.github.io/solid-oidc/).

See also: [Solid OIDC Primer Request Flow](https://solid.github.io/solid-oidc/primer/#request-flow)

## Supports

- DPoP Bound Access Tokens
- Bearer Access Tokens
- Caching of:
  - WebID Identity Providers
  - Identity Providers JSON Web Key Sets
  - A minimalistic version of DPoP tokens identifiers to mitigate replays otherwise mostly
    mitigated by the 60 seconds maximum DPoP Token age, should be improved to take a configurable
    max requests per seconds to avoid overflow of cache before replay. But de facto, if someone really
    wanted to mitigate this attack, they should plug a cache that can support high numbers of requests.
    Someone could easily overflow a lru cache by logging lots of requests as themselves before replaying
    the token. That is if the server can answer fast enough...
- Custom Identity Verification Classes to extend to specific caching strategies if needed

## How to?

Verify Solid Access Tokens with a simple function:

```javascript
import type { RequestMethod, SolidTokenVerifierFunction } from '@solid/access-token-verifier';
import { createSolidTokenVerifier } from '@solid/access-token-verifier';

const solidOidcAccessTokenVerifier: SolidTokenVerifierFunction = createSolidTokenVerifier();

try {
  const { client_id: clientId, webid: webId } = await solidOidcAccessTokenVerifier(
    authorizationHeader as string,
    {
      header: dpopHeader as string,
      method: requestMethod as RequestMethod,
      url: requestURL as string
    }
  );

  console.log(`Verified Access Token via WebID: ${webId} and for client: ${clientId}`);

  return { webId, clientId };
} catch (error: unknown) {
  const message = `Error verifying Access Token via WebID: ${(error as Error).message}`;

  console.log(message);

  throw new Error(message);
}
```

The `solidOidcAccessTokenVerifier` function takes an authorization header which can be an encoded Bearer or DPoP bound access token and optional DPoP parameters.

## TODO

- Further sanitation of inputs? For example a maximum authorization header size. Needs further discussions before resolution.
- Improve default caching? Assess other libraries that might be used.
- Evolve the type guards and the type guard library.
- Allow http over tls on all WebIDs instead of enforcing https as per: https://github.com/solid/authentication-panel/issues/114.
- ~~Enforce client ID when support is wide enough as per: https://solid.github.io/solid-oidc/#tokens-access~~
- Enforce `azp` claim in the next library which should target ID tokens as opposed to Access tokens as per the [updated Solid-OIDC spec](https://solid.github.io/solid-oidc/#tokens-id)
- Enforce DPoP ath claim when support is wide enough as per: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-dpop-04#section-4.2

---
_Source: https://npm.io/package/@solid/access-token-verifier · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._