# fetch-mw-oauth2

> Fetch middleware to add OAuth2 support

Latest version **1.0.2** (published 2022-07-15) · MIT license · 0 weekly downloads

## Install

```sh
npm install fetch-mw-oauth2
pnpm add fetch-mw-oauth2
yarn add fetch-mw-oauth2
bun add fetch-mw-oauth2
```

## Health

**Score 35/100 (D)** — status: abandoned.

Positive: has types; no vulnerabilities; high quality score.

Warnings: low downloads; no esm support.

Negative: abandoned.

## Facts

| | |
|---|---|
| Version | 1.0.2 |
| Published | 2022-07-15 |
| First published | 2019-03-11 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | CommonJS |
| Dependencies | 0 |
| Unpacked size | 68.9 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| GitHub stars | 338 |
| Author | Evert Pot |
| Maintainers | evrt |
| Keywords | fetch, oauth2 |

## Links

- npm: https://www.npmjs.com/package/fetch-mw-oauth2
- Repository: https://github.com/badgateway/fetch-mw-oauth2
- Homepage: https://github.com/badgateway/fetch-mw-oauth2#readme
- Issues: https://github.com/badgateway/fetch-mw-oauth2/issues
- npm.io page: https://npm.io/package/fetch-mw-oauth2

## Alternatives

- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads

## Recent versions

- 1.0.2 (latest) — 2022-07-15
- 2.0.11 (alpha) — 2022-05-17
- 1.0.1 — 2022-06-19
- 2.0.10 — 2022-05-10
- 2.0.9 — 2022-04-26
- 2.0.8 — 2022-04-26
- 2.0.7 — 2022-04-25
- 2.0.6 — 2022-04-25
- 2.0.5 — 2022-04-25
- 2.0.4 — 2022-04-20
- 2.0.3 — 2022-04-20
- 2.0.2 — 2022-04-20
- 2.0.1 — 2022-04-19
- 2.0.0 — 2022-04-19
- 1.0.0 — 2021-10-28
- … 21 more at https://npm.io/package/fetch-mw-oauth2/versions

## README

# fetch-mw-oauth2

_Note that v2 of this package has been renamed to `@badgateway/oauth2-client`. This
package has the same features (and more). v1 will receive some maintenance for the
forseeable future, but uprading is strongly recommended._

This library adds support to OAuth2 to fetch by wrapping the fetch function.
It works both for `fetch()` in a browser, as well as [node-fetch][1].

## Installation

```sh
npm i fetch-mw-oauth2
```

## Usage

The `fetch-mw-oauth2` package effectively works as follows:

1. You pass it OAuth2 instructions
2. It returns an object with a new `fetch()` function.

This new `fetch()` function can now be used in place of the regular fetch,
but it takes responsibility of oauth2 authentication.

### Setup with access and/or refresh token

If you already have an access and/or refresh token obtained through other
means, you can set up the object as such:

```javascript
const { OAuth2 } = require('fetch-mw-oauth2');

const oauth2 = new OAuth2({
  clientId: '...',
  clientSecret: '...', // Optional in some cases
  tokenEndpoint: 'https://auth.example.org/token',
}, {
  accessToken: '...',
  refreshToken: '...',
});

const response = await oauth2.fetch('https://my-api.example.org/articles', {
  method: 'POST',
  body: 'Hello world',
});
```

The fetch function simply calls the javascript `fetch()` function but adds
an `Authorization: Bearer ...` header.

### Setup via authorization_code grant

```javascript
const { OAuth2 } = require('fetch-mw-oauth2');

const oauth2 = new OAuth2({
  grantType: 'authorization_code',
  clientId: '...',
  code: '...',
  redirect_uri: 'https://my-app.example.org/cb',
  tokenEndpoint: 'https://auth.example.org/token',
  codeVerifier: '...' // If PKCE was used in authorization request
});
```

The library does not take responsibility for redirecting a user to an
authorization endpoint and redirecting back. That's up to you. After that's
done though, you should have a `code` variable that you can use to setup
the OAuth2 object.


### Setup via 'password' grant

```javascript
const { OAuth2 } = require('fetch-mw-oauth2');

const oauth2 = new OAuth2({
  grantType: 'password',
  clientId: '...',
  clientSecret: '...',
  userName: '...',
  password: '...',
  tokenEndpoint: 'https://auth.example.org/token',
});
```

### Setup via 'client_credentials' grant

```javascript
const { OAuth2 } = require('fetch-mw-oauth2');

const oauth2 = new OAuth2({
  grantType: 'client_credentials',
  clientId: '...',
  clientSecret: '...',
  tokenEndpoint: 'https://auth.example.org/token',
});
```

## fetchMw function

It might be preferable to use this library as a more traditional 'middleware'.

The OAuth2 object also exposes a `fetchMw` function that takes 2 arguments:

1. `request`
2. `next`

The next argument is a function that also takes a request and returns a
response.

Usually you will want to use this with some kind of fetch middleware container,
as such:

```typescript
myFetchMiddleware(oauth2.fetchMw);
```

But it's also possible to use it directly. For example:

```typescript
oauth2.fetchMw(myRequest, innerRequest => fetch(innerRequest));
```

## Project status

The current features have been implemented:

1. `client_credentials` grant-type support.
2. `password` grant-type support.
3. `authorization_code` grant-type support
4. Automatically refreshing tokens

The following features are planned mid/long-term

1. Supply an OAuth2 discovery document instead of authorization and token uris.
2. `implicit` grant-type support

[1]: https://www.npmjs.com/package/node-fetch

---
_Source: https://npm.io/package/fetch-mw-oauth2 · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._