GitHub

Quickstart

Create an OAuth app in GitHub settings and configure the callback URL as <your-domain>/auth/github/callback.

The GitHub preset already includes endpoint URLs and provider specific defaults. For a basic login flow, configure only:

• redirectUri
• clientId
• clientSecret

github: {
  redirectUri: 'http://localhost:3000/auth/github/callback',
  clientId: '',
  clientSecret: '',
},

NUXT_OIDC_PROVIDERS_GITHUB_CLIENT_SECRET=CLIENT_SECRET
NUXT_OIDC_PROVIDERS_GITHUB_CLIENT_ID=CLIENT_ID

If GitHub is your only configured provider, defaultProvider is inferred automatically and /auth/login redirects to /auth/github/login.

By default, unauthenticated users are redirected automatically by the global middleware. If you prefer button-only login flow, set oidc.middleware.redirect = false.

Feature/OIDC support

❌  PKCE
❌  Nonce
✅  State
❌  Access Token validation
❌  ID Token validation

Introduction

GitHub is not strictly an OIDC provider, but it can be used as one. Make sure that validation is disabled and that you keep the skipAccessTokenParsing option to true.

Try to use a GitHub App, not the legacy OAuth app. They don't provide the same level of security, have no granular permissions, don't provide refresh tokens and are not tested.

Example Configuration

github: {
  redirectUri: 'http://localhost:3000/auth/github/callback',
  clientId: '',
  clientSecret: '',
  filterUserInfo: ['login', 'id', 'avatar_url', 'name', 'email'],
},

Environment variables

Dotenv files are only for (local) development. Use a proper configuration management or injection system in production.

NUXT_OIDC_PROVIDERS_GITHUB_CLIENT_SECRET=CLIENT_SECRET
NUXT_OIDC_PROVIDERS_GITHUB_CLIENT_ID=CLIENT_ID