# oidc-provider
> OAuth 2.0 Authorization Server implementation for Node.js with OpenID Connect
Latest version **9.12.2** (published 2026-09-05) · MIT license · 0 weekly downloads
## Install
```sh
npm install oidc-provider
pnpm add oidc-provider
yarn add oidc-provider
bun add oidc-provider
```
## Health
**Score 68/100 (B)** — status: active.
Positive: has types package; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score.
Warnings: low downloads.
## Facts
| | |
|---|---|
| Version | 9.12.2 |
| Published | 2026-09-05 |
| First published | 2016-04-27 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | separate (@types/oidc-provider) |
| Module format | ESM + CommonJS |
| Dependencies | 3 |
| Unpacked size | 535.4 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 3815 |
| Author | Filip Skokan |
| Maintainers | panva |
| Keywords | appauth, auth, authentication, authorization, basic, certified, ciba, config, connect, device flow, dpop, dynamic, express, fapi, fastify, hapi, hybrid, identity, implicit, jar, jarm, koa, mtls, oauth 2.0, oauth 2.1, oauth, oauth2, oidc, openid, par, pkce, provider, server |
## Links
- npm: https://www.npmjs.com/package/oidc-provider
- Repository: https://github.com/panva/node-oidc-provider
- Issues: https://github.com/panva/node-oidc-provider/issues
- Funding: https://github.com/sponsors/panva
- npm.io page: https://npm.io/package/oidc-provider
## Dependencies (3)
- [koa](https://npm.io/package/koa.md) ^3.2.1
- [jose](https://npm.io/package/jose.md) ^6.2.10
- [debug](https://npm.io/package/debug.md) ^4.4.3
## Alternatives
- [@clerk/clerk-expo](https://npm.io/package/@clerk/clerk-expo.md) — 133.6K weekly downloads
- [@pothos/plugin-authz](https://npm.io/package/@pothos/plugin-authz.md) — 12.4K weekly downloads
- [@bounded-sh/client](https://npm.io/package/@bounded-sh/client.md) — 3.2K weekly downloads
- [@luigi-project/plugin-auth-oauth2](https://npm.io/package/@luigi-project/plugin-auth-oauth2.md) — 2.3K weekly downloads
- [@nocobase/plugin-verification](https://npm.io/package/@nocobase/plugin-verification.md) — 2.0K weekly downloads
## Recent versions
- 9.12.2 (latest) — 2026-09-05
- 6.31.1 (previous) — 2021-03-03
- 9.12.1 — 2026-09-04
- 9.12.0 — 2026-08-28
- 9.11.5 — 2026-08-24
- 9.11.4 — 2026-08-21
- 9.11.3 — 2026-08-08
- 9.11.2 — 2026-08-03
- 9.11.1 — 2026-07-27
- 9.11.0 — 2026-07-26
- 9.10.0 — 2026-07-20
- 9.9.1 — 2026-07-07
- 9.9.0 — 2026-07-06
- 9.8.6 — 2026-06-26
- 9.8.5 — 2026-06-15
- … 366 more at https://npm.io/package/oidc-provider/versions
## README
# oidc-provider
This module provides an OAuth 2.0 ([RFC 6749][oauth2]) Authorization Server with support for OpenID Connect ([OIDC][openid-connect]) and many
other additional features and standards.
**Table of Contents**
- [Implemented specs & features](#implemented-specs--features)
- [Certification](#certification)
- [Documentation & Configuration](#documentation--configuration)
- [Community Guides](#community-guides)
- [Events](#events)
## Implemented specs & features
The following specifications are implemented by oidc-provider (not exhaustive):
_Note that not all features are enabled by default, check the configuration section on how to enable them._
- [`RFC6749` - OAuth 2.0][oauth2] & [`OIDC` Core 1.0][core]
- [OIDC `Discovery 1.0`][discovery] & [`RFC8414` Authorization Server Metadata][rfc8414]
- Dynamic Client Registration
- [OIDC `Dynamic Client Registration 1.0`][registration]
- [`RFC7591` - OAuth 2.0 Dynamic Client Registration Protocol][oauth2-registration]
- [`RFC7592` - OAuth 2.0 Dynamic Client Registration Management Protocol][registration-management]
- [OIDC `RP-Initiated Logout 1.0`][rpinitiated-logout]
- [OIDC `Back-Channel Logout 1.0`][backchannel-logout]
- [`RFC7009` - OAuth 2.0 Token Revocation][revocation]
- [`RFC7636` - Proof Key for Code Exchange (`PKCE`)][pkce]
- [`RFC7662` - OAuth 2.0 Token Introspection][introspection]
- [`RFC8252` - OAuth 2.0 for Native Apps BCP (`AppAuth`)][oauth-native-apps]
- [`RFC8628` - OAuth 2.0 Device Authorization Grant (`Device Flow`)][device-flow]
- [`RFC8705` - OAuth 2.0 Mutual TLS Client Authentication and Certificate Bound Access Tokens (`MTLS`)][mtls]
- [`RFC8707` - OAuth 2.0 Resource Indicators][resource-indicators]
- [`RFC9101` - OAuth 2.0 JWT-Secured Authorization Request (`JAR`)][jar]
- [`RFC9126` - OAuth 2.0 Pushed Authorization Requests (`PAR`)][par]
- [`RFC9207` - OAuth 2.0 Authorization Server Issuer Identifier in Authorization Response][iss-auth-resp]
- [`RFC9396` - OAuth 2.0 Rich Authorization Requests][rar]
- [`RFC9449` - OAuth 2.0 Demonstration of Proof-of-Possession at the Application Layer (`DPoP`)][dpop]
- [`RFC9701` - JWT Response for OAuth Token Introspection][jwt-introspection]
- [FAPI 1.0 Security Profile - Part 2: Advanced (`FAPI 1.0`)][fapi]
- [FAPI 2.0 Security Profile (`FAPI 2.0`)][fapi2sp]
- [FAPI 2.0 Message Signing (`FAPI 2.0`)][fapi2ms]
- [JWT Secured Authorization Response Mode for OAuth 2.0 (`JARM`)][jarm]
- [OIDC Client Initiated Backchannel Authentication Flow (`CIBA`)][ciba]
- [OIDC Relying Party Metadata Choices 1.0][rp-metadata-choices]
Supported Access Token formats:
- Opaque
- [JSON Web Token (JWT) Profile for OAuth 2.0 Access Tokens][jwt-at]
The following specifications and drafts are implemented as experimental features:
- [Financial-grade API: Client Initiated Backchannel Authentication Profile (`FAPI-CIBA`) - Implementers Draft 01][fapi-ciba]
- [OAuth 2.0 Attestation-Based Client Authentication - Draft 10][attestation-client-auth]
- [OAuth Client ID Metadata Document (`CIMD`) - Draft 02][cimd]
- [OpenID for Verifiable Credential Issuance 1.0][openid4vci]
Updates to experimental feature specification versions are released as MINOR library versions,
if you utilize these features consider using the tilde `~` operator in your
package.json since breaking changes may be introduced as part of these version updates. Alternatively
[acknowledge](/docs/README.md#features) the version and be notified of breaking changes as part of
your CI.
## Certification
[][openid-certified-link]
Filip Skokan has [certified][openid-certified-link] that [oidc-provider][npm-url]
conforms to the following profiles of the OpenID Connect™ protocol.
- Basic, Implicit, Hybrid, Config, Form Post, and 3rd Party-Init
- Back-Channel Logout and RP-Initiated Logout
- FAPI 1.0
- FAPI CIBA
- FAPI 2.0
## Sponsor
If you want to quickly add OpenID Connect authentication to Node.js apps, feel free to check out Auth0's Node.js SDK and free plan. [Create an Auth0 account; it's free!][sponsor-auth0]
## Support
If you or your company use this module, or you need help using/upgrading the module, please consider becoming a [sponsor][support-sponsor] so I can continue maintaining it and adding new features carefree. The only way to guarantee you get feedback from the author & sole maintainer of this module is to support the package through GitHub Sponsors.
## [Documentation](/docs/README.md) & Configuration
oidc-provider can be mounted to existing connect, express, fastify, hapi, or koa applications, see
[how](/docs/README.md#mounting-oidc-provider). The authorization server allows to be extended and configured in
various ways to fit a variety of uses. See the [documentation](/docs/README.md) and [example folder](/example).
```js
import * as oidc from "oidc-provider";
const provider = new oidc.Provider("http://localhost:3000", {
// refer to the documentation for other available configuration
clients: [
{
client_id: "foo",
client_secret: "bar",
redirect_uris: ["http://localhost:8080/cb"],
// ... other client properties
},
],
});
const server = provider.listen(3000, () => {
console.log(
"oidc-provider listening on port 3000, check http://localhost:3000/.well-known/openid-configuration",
);
});
```
External type definitions are available via [DefinitelyTyped](https://npmjs.com/package/@types/oidc-provider).
## Community Guides
Collection of Community-maintained configuration use cases are in the [Community Guides Discussions section](https://github.com/panva/node-oidc-provider/discussions/categories/community-guides)
## Events
oidc-provider instances are event emitters, using event handlers you can hook into the various
actions and i.e. emit metrics that react to specific triggers. See the list of available emitted [event names](/docs/events.md) and their description.
## Supported Versions
| Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
| ------------------------------------------------------------- | ----------------- | ------------------ | --------------- |
| [v9.x](https://github.com/panva/node-oidc-provider/tree/v9.x) | [Security Policy] | ✅ | ✅ |
[npm-url]: https://www.npmjs.com/package/oidc-provider
[openid-certified-link]: https://openid.net/certification/
[openid-connect]: https://openid.net/connect/
[core]: https://openid.net/specs/openid-connect-core-1_0-errata2.html
[discovery]: https://openid.net/specs/openid-connect-discovery-1_0-errata2.html
[oauth2-registration]: https://www.rfc-editor.org/info/rfc7591/
[registration]: https://openid.net/specs/openid-connect-registration-1_0-errata2.html
[oauth2]: https://www.rfc-editor.org/info/rfc6749/
[oauth2-bearer]: https://www.rfc-editor.org/info/rfc6750/
[revocation]: https://www.rfc-editor.org/info/rfc7009/
[introspection]: https://www.rfc-editor.org/info/rfc7662/
[pkce]: https://www.rfc-editor.org/info/rfc7636/
[example-repo]: https://github.com/panva/node-oidc-provider-example
[backchannel-logout]: https://openid.net/specs/openid-connect-backchannel-1_0-errata1.html
[registration-management]: https://www.rfc-editor.org/info/rfc7592/
[oauth-native-apps]: https://www.rfc-editor.org/info/rfc8252/
[jar]: https://www.rfc-editor.org/info/rfc9101/
[device-flow]: https://www.rfc-editor.org/info/rfc8628/
[jwt-introspection]: https://www.rfc-editor.org/info/rfc9701/
[sponsor-auth0]: https://a0.to/signup/panva
[mtls]: https://www.rfc-editor.org/info/rfc8705/
[dpop]: https://www.rfc-editor.org/info/rfc9449/
[resource-indicators]: https://www.rfc-editor.org/info/rfc8707/
[jarm]: https://openid.net/specs/oauth-v2-jarm-errata1.html
[jwt-at]: https://www.rfc-editor.org/info/rfc9068/
[support-sponsor]: https://github.com/sponsors/panva
[par]: https://www.rfc-editor.org/info/rfc9126/
[rpinitiated-logout]: https://openid.net/specs/openid-connect-rpinitiated-1_0-final.html
[iss-auth-resp]: https://www.rfc-editor.org/info/rfc9207/
[rar]: https://www.rfc-editor.org/info/rfc9396/
[fapi]: https://openid.net/specs/openid-financial-api-part-2-1_0-final.html
[ciba]: https://openid.net/specs/openid-client-initiated-backchannel-authentication-core-1_0-final.html
[fapi-ciba]: https://openid.net/specs/openid-financial-api-ciba-ID1.html
[fapi2sp]: https://openid.net/specs/fapi-security-profile-2_0-final.html
[fapi2ms]: https://openid.net/specs/fapi-message-signing-2_0-final.html
[Security Policy]: https://github.com/panva/node-oidc-provider/security/policy
[rp-metadata-choices]: https://openid.net/specs/openid-connect-rp-metadata-choices-1_0-final.html
[rfc8414]: https://www.rfc-editor.org/info/rfc8414/
[attestation-client-auth]: https://www.ietf.org/archive/id/draft-ietf-oauth-attestation-based-client-auth-10.html
[cimd]: https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-02.html
[openid4vci]: https://openid.net/specs/openid-4-verifiable-credential-issuance-1_0-final.html
---
_Source: https://npm.io/package/oidc-provider · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._
][openid-certified-link]
Filip Skokan has [certified][openid-certified-link] that [oidc-provider][npm-url]
conforms to the following profiles of the OpenID Connect™ protocol.
- Basic, Implicit, Hybrid, Config, Form Post, and 3rd Party-Init
- Back-Channel Logout and RP-Initiated Logout
- FAPI 1.0
- FAPI CIBA
- FAPI 2.0
## Sponsor