Noticeably Playful Monkeys

    TypeScript icon, indicating that this package has built-in type declarations

    2.7.2 • Public • Published

    Express OpenID Connect

    Express JS middleware implementing sign on for Express web apps using OpenID Connect.

    CircleCI codecov NPM version FOSSA Status

    Table of Contents



    Node.js version >=12.0.0 is recommended, but ^10.19.0 lts/dubnium is also supported.

    npm install express-openid-connect

    Getting Started

    Follow our Secure Local Development guide to ensure that applications using this library are running over secure channels (HTTPS URLs). Applications using this library without HTTPS may experience "invalid state" errors.

    The library needs issuerBaseURL, baseURL, clientID and secret to request and accept authentication. These can be configured with environmental variables:


    ... or in the library initialization:

    // index.js
    const { auth } = require('express-openid-connect');
        issuerBaseURL: 'https://YOUR_DOMAIN',
        baseURL: 'https://YOUR_APPLICATION_ROOT_URL',
        clientID: 'YOUR_CLIENT_ID',
        secret: 'LONG_RANDOM_STRING',
        idpLogout: true,

    With this basic configuration, your application will require authentication for all routes and store the user identity in an encrypted and signed cookie.

    See the examples for route-specific authentication, custom application session handling, requesting and using access tokens for external APIs, and more.

    See the API documentation for additional configuration possibilities and provided methods.

    A note on error handling

    Errors raised by this library are handled by the default Express error handler which, in the interests of security, does not include the stack trace or error message in the production environment. If you write your own error handler, you should not render the error message or the OAuth error/error_description properties without using a templating engine that will properly escape them first.

    To write your own error handler, see the Express documentation on writing Custom error handlers.


    We appreciate feedback and contribution to this repo! Before you get started, please see the following:

    Contributions can be made to this library through PRs to fix issues, improve documentation or add features. Please fork this repo, create a well-named branch, and submit a PR with a complete template filled out.

    Code changes in PRs should be accompanied by tests covering the changed or added functionality. Tests can be run for this library with:

    npm install
    npm test

    When you're ready to push your changes, please run the lint command first:

    npm run lint

    Support + Feedback

    Please use the Issues queue in this repo for questions and feedback.

    Vulnerability Reporting

    Please do not report security vulnerabilities on the public GitHub issue tracker. The Responsible Disclosure Program details the procedure for disclosing security issues.

    What is Auth0?

    Auth0 helps you to easily:

    • implement authentication with multiple identity providers, including social (e.g., Google, Facebook, Microsoft, LinkedIn, GitHub, Twitter, etc), or enterprise (e.g., Windows Azure AD, Google Apps, Active Directory, ADFS, SAML, etc.)
    • log in users with username/password databases, passwordless, or multi-factor authentication
    • link multiple user accounts together
    • generate signed JSON Web Tokens to authorize your API calls and flow the user identity securely
    • access demographics and analytics detailing how, when, and where users are logging in
    • enrich user profiles from other data sources using customizable JavaScript rules

    Why Auth0?


    This project is licensed under the MIT license. See the LICENSE file for more info.

    FOSSA Status




    npm i express-openid-connect

    DownloadsWeekly Downloads






    Unpacked Size

    83.4 kB

    Total Files


    Last publish


    • willvedd
    • david.renaud.okta
    • jeff.shuman
    • cristian.j.gonzalez
    • auth0-oss
    • codepete
    • texeira
    • ziluvatar
    • iaco
    • cocojoe
    • fyockm
    • auth0npm
    • auth0alec
    • auth0brokkr
    • hzalaz
    • glena
    • aaguiarz
    • charlesrea
    • lbalmaceda
    • jstrutz
    • julien.wollscheid
    • cristiandouce
    • heyitsry
    • sambego
    • stevehobbsdev
    • davidmoses
    • sandrinodimattia
    • lzychowski
    • joshcanhelp
    • rob.coles
    • faroceann
    • rosnovsky
    • davidpatrick0
    • widcket
    • adamjmcgrath
    • ldoorz
    • th3maio
    • jim.andersoon
    • fadymak
    • navrupt
    • frederikprijck
    • sergii.biienko
    • tomauth0
    • jakewlacey
    • jpadilla
    • jessele
    • shushen
    • rhamzeh_auth0
    • greglopez
    • jfromaniello