[{"data":1,"prerenderedAt":1149},["ShallowReactive",2],{"navigation":3,"search-sections":125,"\u002Fprovider\u002Flogto":814,"\u002Fprovider\u002Flogto-surround":1136,"ghrelease":1139},[4,26,74,92,96,100,104,108,112,116],{"title":5,"path":6,"stem":7,"children":8,"to":11,"external":12,"target":11,"icon":25},"Getting Started","\u002Fgetting-started","1.getting-started\u002F1.index",[9,13,17,21],{"title":10,"path":6,"stem":7,"to":11,"external":12,"target":11},"Introduction",null,false,{"title":14,"path":15,"stem":16,"to":11,"external":12,"target":11},"Installation","\u002Fgetting-started\u002Finstallation","1.getting-started\u002F2.installation",{"title":18,"path":19,"stem":20,"to":11,"external":12,"target":11},"Security","\u002Fgetting-started\u002Fsecurity","1.getting-started\u002F3.security",{"title":22,"path":23,"stem":24,"to":11,"external":12,"target":11},"Providers","\u002Fgetting-started\u002Fproviders","1.getting-started\u002F4.providers","i-carbon-book",{"title":27,"path":28,"stem":29,"children":30,"to":11,"external":12,"target":11,"icon":73},"Provider","\u002Fprovider","2.provider\u002F1.index",[31,33,37,41,45,49,53,57,61,65,69],{"title":32,"path":28,"stem":29,"to":11,"external":12,"target":11},"Overview",{"title":34,"path":35,"stem":36,"to":11,"external":12,"target":11},"Zitadel","\u002Fprovider\u002Fzitadel","2.provider\u002F10.zitadel",{"title":38,"path":39,"stem":40,"to":11,"external":12,"target":11},"Auth0","\u002Fprovider\u002Fauth0","2.provider\u002F2.auth0",{"title":42,"path":43,"stem":44,"to":11,"external":12,"target":11},"AWS Cognito","\u002Fprovider\u002Faws-cognito","2.provider\u002F3.aws-cognito",{"title":46,"path":47,"stem":48,"to":11,"external":12,"target":11},"Entra ID","\u002Fprovider\u002Fentra","2.provider\u002F4.entra",{"title":50,"path":51,"stem":52,"to":11,"external":12,"target":11},"GitHub","\u002Fprovider\u002Fgithub","2.provider\u002F5.github",{"title":54,"path":55,"stem":56,"to":11,"external":12,"target":11},"KeyCloak","\u002Fprovider\u002Fkeycloak","2.provider\u002F6.keycloak",{"title":58,"path":59,"stem":60,"to":11,"external":12,"target":11},"Logto","\u002Fprovider\u002Flogto","2.provider\u002F7.logto",{"title":62,"path":63,"stem":64,"to":11,"external":12,"target":11},"Microsoft","\u002Fprovider\u002Fmicrosoft","2.provider\u002F8.microsoft",{"title":66,"path":67,"stem":68,"to":11,"external":12,"target":11},"PayPal","\u002Fprovider\u002Fpaypal","2.provider\u002F9.paypal",{"title":70,"path":71,"stem":72,"to":11,"external":12,"target":11},"Generic OIDC (advanced)","\u002Fprovider\u002Foidc","2.provider\u002F99.oidc","i-carbon-block-storage",{"title":75,"to":11,"external":12,"target":11,"icon":76,"path":77,"stem":78,"children":79,"page":12},"Server utils","i-carbon-bare-metal-server","\u002Fserver-utils","3.server-utils",[80,84,88],{"title":81,"path":82,"stem":83,"to":11,"external":12,"target":11},"Middleware","\u002Fserver-utils\u002Fmiddleware","3.server-utils\u002F1.middleware",{"title":85,"path":86,"stem":87,"to":11,"external":12,"target":11},"Session management","\u002Fserver-utils\u002Fsession-management","3.server-utils\u002F2.session-management",{"title":89,"path":90,"stem":91,"to":11,"external":12,"target":11},"OIDC Handler","\u002Fserver-utils\u002Foidc-handlers","3.server-utils\u002F3.oidc-handlers",{"title":93,"path":94,"stem":95,"to":11,"external":12,"target":11},"Composable","\u002Fcomposable","4.composable",{"title":97,"path":98,"stem":99,"to":11,"external":12,"target":11},"Dev mode","\u002Fdev-mode","5.dev-mode",{"title":101,"path":102,"stem":103,"to":11,"external":12,"target":11},"Single sign-out","\u002Fsingle-sign-out","5.single-sign-out",{"title":105,"path":106,"stem":107,"to":11,"external":12,"target":11},"Hooks","\u002Fhooks","6.hooks",{"title":109,"path":110,"stem":111,"to":11,"external":12,"target":11},"Configuration reference","\u002Fconfiguration","7.configuration",{"title":113,"path":114,"stem":115,"to":11,"external":12,"target":11},"Contributing","\u002Fcontributing","99.contributing",{"title":117,"path":118,"stem":119,"children":120,"to":122,"external":123,"target":124},"Changelog","\u002Fchangelog","changelog\u002Findex",[121],{"title":117,"path":118,"stem":119,"to":122,"external":123,"target":124},"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fblob\u002Fmain\u002FCHANGELOG.md",true,"_blank",[126,130,136,142,147,152,157,162,166,171,176,179,183,188,193,196,201,206,211,216,221,226,229,233,238,241,245,250,255,258,263,267,272,277,282,285,289,292,296,301,305,309,312,316,320,324,328,331,335,339,343,347,351,354,359,363,367,371,375,378,382,386,391,396,401,406,410,414,417,421,425,429,434,438,442,445,448,452,455,459,464,469,474,478,482,485,489,493,498,503,506,510,514,517,521,525,529,532,536,539,544,549,552,557,561,564,568,573,578,583,588,592,596,601,605,608,613,618,623,627,630,635,639,643,648,651,655,660,665,670,676,681,686,691,696,699,703,708,713,718,723,728,731,735,740,743,747,752,757,762,767,772,777,782,787,792,797,800,804,809],{"id":6,"title":10,"titles":127,"content":128,"level":129},[],"Welcome to Nuxt OIDC Auth Welcome to Nuxt OIDC Auth, a Nuxt module focusing on native OIDC (OpenID Connect) based authentication for Nuxt with a high level of customizability and security for SSR applications.\nThis module doesn't use any external dependencies outside of the unjs ecosystem except for token validation (the well known and tested jose library for JWT interactions).\nThis module's session implementation is based on nuxt-auth-utils. This module and it's authors are in no way or form connected to the OpenID Foundation (OIDF). Read disclaimer",1,{"id":131,"title":132,"titles":133,"content":134,"level":135},"\u002Fgetting-started#nuxt-oidc-auth-features","Nuxt OIDC Auth Features",[10],"",2,{"id":137,"title":138,"titles":139,"content":140,"level":141},"\u002Fgetting-started#secure","🔒  Secure",[10,132],"Session expiration check based on token expirationAutomatic session renewal based on token expiration and refresh tokensSecured & sealed cookies sessionsAccess and ID token cryptographic validation (if supported by provider)Encrypted server side refresh\u002Faccess token storage powered Nitro storage layer",3,{"id":143,"title":144,"titles":145,"content":146,"level":141},"\u002Fgetting-started#️-nuxt-integrated","⚙️  Nuxt integrated",[10,132],"Global middleware with automatic redirection to default provider or custom login pageuseOidcAuth composable for getting the user information, logging in and out, refetching the current session and triggering a token refreshServer side session and middleware integration",{"id":148,"title":149,"titles":150,"content":151,"level":141},"\u002Fgetting-started#compatible","📝  Compatible",[10,132],"Generic spec compatible OpenID connect provider with fully configurable OIDC flow (state, nonce, PKCE, token request, ...)Presets for popular OIDC providersMulti provider support with auto registered routes (\u002Fauth\u002F\u003Cprovider>\u002Flogin, \u002Fauth\u002F\u003Cprovider>\u002Flogout, \u002Fauth\u002F\u003Cprovider>\u002Fcallback)",{"id":153,"title":154,"titles":155,"content":156,"level":135},"\u002Fgetting-started#quickstarts","Quickstarts",[10],"Use minimal provider-specific setup guides when you just want a fast login flow: GitHub QuickstartAuth0 Setup GuideAWS Cognito Setup GuideEntra ID Setup GuideKeycloak Setup GuideMicrosoft Setup Guide See all available entries in Getting Started Providers.",{"id":158,"title":159,"titles":160,"content":161,"level":135},"\u002Fgetting-started#recent-breaking-changes","Recent breaking changes",[10],"Since 0.16.0, the data from the providers userInfo endpoint is written into userInfo on the user object instead of providerInfo.\nPlease adjust your nuxt.config.ts and .env\u002Fenvironment files and configurations accordingly.\nIf you are using the user object from the useOidcAuth composable change the access to providerInfo to userInfo.",{"id":163,"title":164,"titles":165,"content":134,"level":135},"\u002Fgetting-started#disclaimer","Disclaimer",[10],{"id":167,"title":168,"titles":169,"content":170,"level":141},"\u002Fgetting-started#openid-connect","OpenID Connect",[10,164],"This project and its authors are not affiliated with, endorsed by, or in any way officially connected with the OpenID Foundation (OIDF) or any of its subsidiaries or affiliates. Any references to OpenID or the OpenID Foundation are purely for descriptive purposes, and the use of their name does not imply any form of association or endorsement. Furthermore, the logo and branding used in this project are the property of the authors and are not derived from or related to any logos or trademarks of the OpenID Foundation. All rights to the project logo are owned exclusively by the authors.",{"id":172,"title":173,"titles":174,"content":175,"level":141},"\u002Fgetting-started#status","Status",[10,164],"This module is still in development, feedback and contributions are welcome! Use at your own risk.",{"id":15,"title":14,"titles":177,"content":178,"level":129},[],"Get started with nuxt-oidc-auth",{"id":180,"title":181,"titles":182,"content":134,"level":135},"\u002Fgetting-started\u002Finstallation#quick-start","Quick Start",[14],{"id":184,"title":185,"titles":186,"content":187,"level":141},"\u002Fgetting-started\u002Finstallation#add-nuxt-oidc-auth-dependency-to-your-project","Add nuxt-oidc-auth dependency to your project",[14,181],"Using nuxi pnpm dlx nuxi@latest module add nuxt-oidc-auth\nyarn dlx nuxi@latest module add nuxt-oidc-auth\nnpx nuxi@latest module add nuxt-oidc-auth Or manually installing pnpm add nuxt-oidc-auth\nyarn add nuxt-oidc-auth\nnpm install nuxt-oidc-auth",{"id":189,"title":190,"titles":191,"content":192,"level":141},"\u002Fgetting-started\u002Finstallation#configure-provider","Configure provider",[14,181],"Configure one of the predefined providers in your nuxt.config.ts under oidc.providers and inject credentials through environment variables. export default defineNuxtConfig({\n  modules: ['nuxt-oidc-auth'],\n  oidc: {\n    providers: {\n      github: {\n        redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fgithub\u002Fcallback',\n        clientId: '',\n        clientSecret: '',\n      },\n    },\n  },\n}) NUXT_OIDC_PROVIDERS_GITHUB_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_GITHUB_CLIENT_SECRET=CLIENT_SECRET Need a minimal provider-first setup? Use Provider quickstarts. For stable sessions across restarts and production environments, configure the module secrets.",{"id":19,"title":18,"titles":194,"content":195,"level":129},[],"Security is a main priority",{"id":197,"title":198,"titles":199,"content":200,"level":135},"\u002Fgetting-started\u002Fsecurity#background","Background",[18],"In this library, we’ve chosen to implement OAuth and OpenID flows from the ground up to provide flexibility and meet specific requirements and to be flexible. Not only has every OIDC providr it's own needs, but we also want to stay as close to the standards defined by OpenID Connect and OAuth 2.0 specifications. However, we strictly avoided writing our own cryptographic functions, instead relying on the well-tested libraries jose for token validation and noble-ciphers for cryptographic operations. Both of which are 0-dependency libraries. This approach ensures that while we retain control over the authentication flows, we benefit from the security guarantees provided by audited and widely trusted cryptographic implementations, which are essential to avoid vulnerabilities and security flaws.",{"id":202,"title":203,"titles":204,"content":205,"level":135},"\u002Fgetting-started\u002Fsecurity#oauth-20","OAuth 2.0",[18],"This module only implements the Authorization Code Flow and optionally the Hybrid Flow in a confidential client scenario as detailed in the OpenID Connect specification.\nWe will not support the Implicit Flow in the future, as it should not be used anymore and was practically superseded by the Authorization Code Flow.\nWe will also not support the Client Credential Flow, as it is not part of OIDC, but of OAuth2 and is correctly named Client Credentials Grant. It is basically just an exchange of credentials for a token, is not meant for user authentication and can easily be implemented using a simple fetch request.",{"id":207,"title":208,"titles":209,"content":210,"level":135},"\u002Fgetting-started\u002Fsecurity#nuxt","Nuxt",[18],"This module only works with SSR (server-side rendering) enabled as it uses server API routes. You cannot use this module with nuxt generate or ssr turned off. We are currently investigating if and how to support prerendering.",{"id":212,"title":213,"titles":214,"content":215,"level":135},"\u002Fgetting-started\u002Fsecurity#session-encryption","Session encryption",[18],"We store sensitive data, especially the refresh_token, access_token and id_token in an encrypted persistent session object. This library uses the Nitro storage layer to interact with data and uses the oidc namespace.\nHere is an example configuration. You can also replace the storage by any supported Nitro storage providers like redis, just keep in mind that the underlying storage has impact on the authentication process duration depending on its latency. nitro: {\n    preset: 'node-server',\n    storage: { \u002F\u002F Use local file system storage for dev quick setup\n      oidc: {\n        driver: 'fs',\n        base: 'oidcstorage',\n      },\n    },\n  },",{"id":217,"title":218,"titles":219,"content":220,"level":141},"\u002Fgetting-started\u002Fsecurity#configure-secrets","Configure secrets",[18,213],"Nuxt OIDC Auth uses three different secrets to encrypt the user session, the individual auth sessions and the persistent server side token store. You can set them using environment variables or in the .env file.\nAll of the secrets are auto generated if not set, but should be set manually in production. This is especially important for the session storage, as it won't be accessible anymore if the secret changes, for example, after a server restart. If a refreshable cookie session still exists but its persistent oidc storage entry is missing (for example after container or storage changes), the module clears the stale session by default and requires a fresh login. You can change this behavior with session.missingPersistentSession (clear, warn, silent). If you need a reference how you could generate random secrets or keys, we created an example as a starting point: Secrets generation example NUXT_OIDC_TOKEN_KEY (random key): This needs to be a random cryptographic AES key in base64. Used to encrypt the server side token store. You can generate a key in JS with await subtle.exportKey('raw', await subtle.generateKey({ name: 'AES-GCM', length: 256, }, true, ['encrypt', 'decrypt'])). You just have to encode it to base64 afterwards.NUXT_OIDC_SESSION_SECRET (random string): This should be a at least 48 characters random string. It is used to encrypt the user session.NUXT_OIDC_AUTH_SESSION_SECRET (random string): This should be a at least 48 characters random string. It is used to encrypt the individual sessions during OAuth flows. Add a NUXT_OIDC_SESSION_SECRET env variable with at least 48 characters in the .env file. # .env\nNUXT_OIDC_TOKEN_KEY=base64_encoded_key\nNUXT_OIDC_SESSION_SECRET=48_characters_random_string\nNUXT_OIDC_AUTH_SESSION_SECRET=48_characters_random_string",{"id":222,"title":223,"titles":224,"content":225,"level":135},"\u002Fgetting-started\u002Fsecurity#token-validation","Token validation",[18],"ID and access token validation involves verifying the integrity and claims of the ID token (usually a JWT) to authenticate the user, and validating the access token by checking its signature, expiration, issuer, and audience to ensure it grants appropriate permissions for resource access. This is critical to prevent token tampering, misuse, and unauthorized access to protected APIs or services. We use the well-known and tested jose library for JWT validation. Configure provider-level tokenValidationMode: 'strict' to validate every enabled JWT in callback and refresh token responses without trusting its decoded claims first. Strict validation verifies signature, expiration, issuer, and token-specific audience: Access tokens use configured audience.ID tokens use configured clientId and require sub and iat. Present azp must match clientId, and multi-audience ID tokens require it. Callback ID tokens also require a matching authentication-request nonce when nonce is enabled. Refreshed ID tokens must retain the original ID-token subject and, when present, authentication time. Strict access-token validation requires audience. Any enabled strict validation requires OpenID discovery metadata containing issuer and jwks_uri. If validateIdToken is enabled, token response must include an ID token. legacy remains default for current production line. During callbacks, it validates enabled tokens only when decoded aud exactly equals configured audience or client ID, and emits one migration warning per provider when validation is skipped. Refresh responses retain existing parsing behavior. Migrate providers issuing JWTs to strict after configuring required audience and discovery metadata. strict is intended to become default in next explicitly breaking release. Strict refresh validation runs before session or persistent token state is updated. Invalid responses use existing refresh failure handling to clear stale session state. Some providers, including Auth0 configurations without API audience, may issue opaque access tokens. Preserve support explicitly with validateAccessToken: false and skipAccessTokenParsing: true; ID-token validation can remain enabled independently. tokenValidationMode: 'strict' does not override these opt-outs and validates only token types enabled by their validate*Token flag. Offline end-to-end tests use the generic oidc fixture with deterministic test-only signing keys, matching discovery and JWKS metadata, and strict access-token and ID-token validation. Integrated coverage exercises login, refresh, logout, and rejection of invalid signatures, issuer or audience mismatches, and nonce mismatches without a live identity provider.",{"id":23,"title":22,"titles":227,"content":228,"level":129},[],"Quick links for provider setup and quickstarts",{"id":230,"title":154,"titles":231,"content":232,"level":135},"\u002Fgetting-started\u002Fproviders#quickstarts",[22],"GitHub Quickstart",{"id":234,"title":235,"titles":236,"content":237,"level":135},"\u002Fgetting-started\u002Fproviders#provider-setup-guides","Provider setup guides",[22],"Auth0AWS CognitoEntra IDGitHubKeycloakLogtoMicrosoftPayPalZitadelGeneric OIDC (advanced)",{"id":28,"title":32,"titles":239,"content":240,"level":129},[],"Use one of the built in providers for the best experience",{"id":242,"title":154,"titles":243,"content":244,"level":135},"\u002Fprovider#quickstarts",[32],"GitHub Quickstart More provider quickstarts will be added over time.",{"id":246,"title":247,"titles":248,"content":249,"level":135},"\u002Fprovider#authentication-provider-presets","Authentication Provider Presets",[32],"Nuxt OIDC Auth includes presets for the following providers with tested default values: Auth0AWS CognitoEntra IDGitHubLogtoKeyCloakMicrosoftPayPalZitadelGeneric OIDC",{"id":251,"title":252,"titles":253,"content":254,"level":141},"\u002Fprovider#provider-specific-configurations","Provider specific configurations",[32,247],"Some providers have specific additional fields that can be used to extend the authorization, logout or token request. These fields are available via. additionalAuthParameters, additionalLogoutParameters or additionalTokenParameters in the provider configuration. In legacy mode, enabled callback token validation runs only when decoded token audiences match clientId or configured audience, while refresh responses retain existing parsing behavior. Strict mode validates every enabled JWT in callback and refresh token responses with token-specific audience rules. Providers issuing opaque access tokens require explicit validation and parsing opt-outs. See security guidance for migration details. The redirectUri property is always required and should always point to the callback uri of the specific provider. For Auth0 it should look like this https:\u002F\u002FYOURDOMAIN\u002Fauth\u002Fauth0\u002Fcallback. The playgrounds nuxt.config.ts has examples for multiple providers. If there is no preset for your provider, you can add a generic OpenID Connect provider by using the oidc provider key in the configuration. Remember to set the required fields and expect your provider to behave slightly different than defined in the OAuth and OIDC specifications.\nFor security reasons, you should avoid writing the client secret directly in the nuxt.config.ts file. You can use environment variables to inject settings into the runtime config. Check the .env.example file in the playground folder for reference. Also consider creating an issue to request additional providers being added. # OIDC MODULE CONFIG\nNUXT_OIDC_TOKEN_KEY=\nNUXT_OIDC_SESSION_SECRET=\nNUXT_OIDC_AUTH_SESSION_SECRET=\n# AUTH0 PROVIDER CONFIG\nNUXT_OIDC_PROVIDERS_AUTH0_CLIENT_SECRET=\nNUXT_OIDC_PROVIDERS_AUTH0_CLIENT_ID=\nNUXT_OIDC_PROVIDERS_AUTH0_BASE_URL=\n# KEYCLOAK PROVIDER CONFIG\nNUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET=\nNUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_ID=\nNUXT_OIDC_PROVIDERS_KEYCLOAK_BASE_URL=\n...",{"id":35,"title":34,"titles":256,"content":257,"level":129},[],"Zitadel provider documentation",{"id":259,"title":260,"titles":261,"content":262,"level":135},"\u002Fprovider\u002Fzitadel#featureoidc-support","Feature\u002FOIDC support",[34],"✅  PKCE\n✅  Nonce\n✅  State\n❌  Access Token validation\n✅  ID Token validation",{"id":264,"title":10,"titles":265,"content":266,"level":135},"\u002Fprovider\u002Fzitadel#introduction",[34],"For Zitadel you have to provide at least the baseUrl, clientId and redirectUri properties. The baseUrl is used to dynamically create the authorizationUrl, tokenUrl, logoutUrl and userInfoUrl.\nThe preset uses PKCE with authenticationScheme: 'none', so public clients omit clientSecret. Confidential clients can use authenticationScheme: 'header' or 'body' and must provide a non-empty client secret.",{"id":268,"title":269,"titles":270,"content":271,"level":135},"\u002Fprovider\u002Fzitadel#provider-specific-parameters","Provider specific parameters",[34],"This providers doesn't have specific parameters.",{"id":273,"title":274,"titles":275,"content":276,"level":135},"\u002Fprovider\u002Fzitadel#example-configuration","Example Configuration",[34],"Never store sensitive values like client secrets in your Nuxt config. Inject confidential-client secrets through environment variables. zitadel: {\n  clientId: '',\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fzitadel\u002Fcallback', \u002F\u002F Replace with your domain\n  baseUrl: '', \u002F\u002F For example https:\u002F\u002FPROJECT.REGION.zitadel.cloud\n  audience: '', \u002F\u002F Specify for id token validation, normally same as clientId\n  logoutRedirectUri: 'https:\u002F\u002Fgoogle.com', \u002F\u002F Needs to be registered in Zitadel portal\n  authenticationScheme: 'none',\n},",{"id":278,"title":279,"titles":280,"content":281,"level":141},"\u002Fprovider\u002Fzitadel#environment-variables","Environment variables",[34,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_ZITADEL_CLIENT_ID=123456789012345678\nNUXT_OIDC_PROVIDERS_ZITADEL_BASE_URL=https:\u002F\u002FPROJECT.us1.zitadel.cloud\u002F",{"id":39,"title":38,"titles":283,"content":284,"level":129},[],"Auth0 provider documentation",{"id":286,"title":260,"titles":287,"content":288,"level":135},"\u002Fprovider\u002Fauth0#featureoidc-support",[38],"✅  PKCE\n❌  Nonce\n✅  State\n✅  Access Token validation\n⚠️  ID Token validation (Supported, but disabled by default)",{"id":290,"title":10,"titles":291,"content":134,"level":135},"\u002Fprovider\u002Fauth0#introduction",[38],{"id":293,"title":269,"titles":294,"content":295,"level":135},"\u002Fprovider\u002Fauth0#provider-specific-parameters",[38],"Additional parameters to be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters: OptionTypeDefaultDescriptionconnectionstring-Optional. Forces the user to sign in with a specific connection. For example, you can pass a value of github to send the user directly to GitHub to log in with their GitHub account. When not specified, the user sees the Auth0 Lock screen with all configured connections. You can see a list of your configured connections on the Connections tab of your application.organizationstring-Optional. ID of the organization to use when authenticating a user. When not provided, if your application is configured to Display Organization Prompt, the user will be able to enter the organization name when authenticating.invitationstring-Optional. Ticket ID of the organization invitation. When inviting a member to an Organization, your application should handle invitation acceptance by forwarding the invitation and organization key-value pairs when the user accepts the invitation.loginHintstring-Optional. Populates the username\u002Femail field for the login or signup page when redirecting to Auth0. Supported by the Universal Login experience.audiencestring-Optional. The unique identifier of the API your web app wants to access. Depending on the settings of your apps Credentials tab, set authenticationScheme to body for 'Client Secret (Post)', set to header for 'Client Secret (Basic)', set to '' for 'None'",{"id":297,"title":298,"titles":299,"content":300,"level":135},"\u002Fprovider\u002Fauth0#opaque-access-tokens-without-an-audience","Opaque access tokens without an audience",[38],"When no API audience is requested or configured as the tenant's default, Auth0 issues an opaque access token intended for its \u002Fuserinfo endpoint. Opaque tokens cannot be decoded or validated locally as JWTs, so configure both access-token opt-outs: auth0: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fauth0\u002Fcallback',\n  baseUrl: '',\n  clientId: '',\n  clientSecret: '',\n  skipAccessTokenParsing: true,\n  tokenValidationMode: 'strict',\n  validateAccessToken: false,\n  validateIdToken: true,\n}, Strict mode does not override the access-token opt-outs and validates the enabled ID token independently while preserving the opaque access token.",{"id":302,"title":274,"titles":303,"content":304,"level":135},"\u002Fprovider\u002Fauth0#example-configuration",[38],"Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via. environment variables. auth0: {\n  audience: 'test-api-oidc', \u002F\u002F In case you need access to an API registered in Auth0\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fauth0\u002Fcallback',\n  baseUrl: '', \u002F\u002F For example https:\u002F\u002Fdev-xyz.eu.auth0.com or leave blank for environment\n  clientId: '', \u002F\u002F Leave blank to use environment variable\n  clientSecret: '', \u002F\u002F Leave blank to use environment variable\n  scope: ['openid', 'offline_access', 'profile', 'email'],\n  additionalTokenParameters: { \u002F\u002F In case you need access to an API registered in Auth0\n    audience: 'test-api-oidc',\n  },\n  additionalAuthParameters: { \u002F\u002F In case you need access to an API registered in Auth0\n    audience: 'test-api-oidc',\n  },\n}, Make sure these grants are enabled in Auth0:",{"id":306,"title":279,"titles":307,"content":308,"level":141},"\u002Fprovider\u002Fauth0#environment-variables",[38,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_AUTH0_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_AUTH0_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_AUTH0_BASE_URL=https:\u002F\u002Fdev-xyz.eu.auth0.com",{"id":43,"title":42,"titles":310,"content":311,"level":129},[],"AWS Cognito provider documentation",{"id":313,"title":260,"titles":314,"content":315,"level":135},"\u002Fprovider\u002Faws-cognito#featureoidc-support",[42],"✅  PKCE\n✅  Nonce\n✅  State\n❌  Access Token validation\n❌  ID Token validation AWS Congito doesn't correctly implement the OAuth 2 standard and doesn't provide a aud field for the audience. Therefore it is not possible to verify the access or id token.",{"id":317,"title":10,"titles":318,"content":319,"level":135},"\u002Fprovider\u002Faws-cognito#introduction",[42],"For AWS Cognito you have to provide at least the baseUrl, clientId, clientSecret and logoutRedirectUri properties. The baseUrl is used to dynamically create the authorizationUrl, tokenUrl, logoutUrl and userInfoUrl.\nThe only supported OAuth grant type is Authorization code grant.\nThe final url should look something like this https:\u002F\u002Fcognito-idp.eu-north-1.amazonaws.com\u002Feu-north-1_SOMEID\u002F.well-known\u002Fopenid-configuration.\nYou will also encounter an error, if you have not correctly registered the redirectUri under \"Allowed callback URLs\" or the logoutRedirectUri under \"Allowed sign-out URLs\".\nIf you need additional scopes, specify them in the scope property in you nuxt config like scope: ['openid', 'email', 'profile'],.",{"id":321,"title":274,"titles":322,"content":323,"level":135},"\u002Fprovider\u002Faws-cognito#example-configuration",[42],"Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via. environment variables. cognito: {\n  clientId: '',\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fcognito\u002Fcallback',\n  clientSecret: '',\n  scope: ['openid', 'email', 'profile'],\n  logoutRedirectUri: 'https:\u002F\u002Fgoogle.com',\n  baseUrl: '',\n  exposeIdToken: true, \u002F\u002F This is necessary to validate the logout redirect. If you don't need the ID token and don't use a logout redirect, set this to false.\n},",{"id":325,"title":279,"titles":326,"content":327,"level":141},"\u002Fprovider\u002Faws-cognito#environment-variables",[42,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_COGNITO_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_COGNITO_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_COGNITO_BASE_URL=https:\u002F\u002FYOURAPP.auth.eu-north-1.amazoncognito.com",{"id":47,"title":46,"titles":329,"content":330,"level":129},[],"Entra ID provider documentation",{"id":332,"title":260,"titles":333,"content":334,"level":135},"\u002Fprovider\u002Fentra#featureoidc-support",[46],"✅  PKCE\n✅  Nonce\n✅  State\n⚠️  Access Token validation (Supported, but disabled as only possible for custom audience tokens)\n✅  ID Token validation",{"id":336,"title":10,"titles":337,"content":338,"level":135},"\u002Fprovider\u002Fentra#introduction",[46],"This provider is specifically preconfigured to be used with Entra ID or Entra External ID (successor of Azure AD B2C).\nIf you just need a social login using a Microsoft Account, use the Microsoft provider, which provides a simplified version for social login. If you are requesting a token for an application registered in Entra ID (for example an API), you need to set the resource to the id of that app registration. You should also set the audience to that ID, so the token can be correctly validated. You should also consider setting the userInfoUrl to https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fme if you are just requesting permission scopes for Graph API. This endpoint will not work for custom APIs\u002FApp registrations.",{"id":340,"title":269,"titles":341,"content":342,"level":135},"\u002Fprovider\u002Fentra#provider-specific-parameters",[46],"Additional parameters to be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters: OptionTypeDefaultDescriptionresourcestring-Optional. The resource identifier for the requested resource.audiencestring-Optional. The audience for the token, typically the client ID.promptstring-Optional. Indicates the type of user interaction that is required. Valid values are login, none, consent, and select_account.loginHintstring-Optional. You can use this parameter to pre-fill the username and email address field of the sign-in page for the user. Apps can use this parameter during reauthentication, after already extracting the login_hint optional claim from an earlier sign-in.logoutHintstring-Optional. Enables sign-out to occur without prompting the user to select an account. To use logout_hint, enable the login_hint optional claim in your client application and use the value of the login_hint optional claim as the logout_hint parameter.domainHintstring-Optional. If included, the app skips the email-based discovery process that user goes through on the sign-in page, leading to a slightly more streamlined user experience. If you want to validate access tokens from Microsoft Entra ID (previously Azure AD), you need to make sure that the scope includes your own API. You have to register an API first and expose some scopes to your App Registration that you want to request. If you only have GraphAPI entries like openid, mail GraphAPI specific ones in your scope, the returned access token cannot and should not be verified. If the scope is set correctly, you can set validateAccessToken option to true. If you use this module with Entra External ID (previously Entra ID for Customers) make sure you have set the audience config field to your application id, otherwise it will not be possible to get a valid OpenID Connect well-known configuration and thereby verify the JWT token.",{"id":344,"title":274,"titles":345,"content":346,"level":135},"\u002Fprovider\u002Fentra#example-configuration",[46],"Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via. environment variables. entra: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fentra\u002Fcallback',\n  clientId: '',\n  clientSecret: '',\n  authorizationUrl: 'https:\u002F\u002Flogin.microsoftonline.com\u002F{TENANT_ID}\u002Foauth2\u002Fv2.0\u002Fauthorize', \u002F\u002F For Entra External ID, use https:\u002F\u002FTENANT_NAME.ciamlogin.com\u002FTENANT_ID\u002Foauth2\u002Fauthorize\n  tokenUrl: 'https:\u002F\u002Flogin.microsoftonline.com\u002F{TENANT_ID}\u002Foauth2\u002Fv2.0\u002Ftoken', \u002F\u002F For Entra External ID, use https:\u002F\u002FTENANT_NAME.ciamlogin.com\u002FTENANT_ID\u002Foauth2\u002Ftoken\n  userNameClaim: 'unique_name',\n  nonce: true,\n  responseType: 'code id_token',\n  scope: ['profile', 'openid', 'offline_access', 'email'],\n  logoutUrl: 'https:\u002F\u002Flogin.microsoftonline.com\u002FTENANT_ID\u002Foauth2\u002Flogout', \u002F\u002F For Entra External ID, use https:\u002F\u002FTENANT_NAME.ciamlogin.com\u002FTENANT_ID\u002Foauth2\u002Flogout\n  optionalClaims: ['unique_name', 'family_name', 'given_name', 'login_hint'],\n  audience: '', \u002F\u002F In case you need access to an App\u002FAPI registered in Entra ID\n  additionalAuthParameters: {\n    resource: '', \u002F\u002F Needs to match the audience\n    prompt: 'select_account', \u002F\u002F 'login' | 'none' | 'consent' | 'select_account'\n  },\n  additionalLogoutParameters: {\n    logoutHint: '', \u002F\u002F Enables sign-out to occur without prompting the user to select an account. Remove if you don't need this or don't have requested the `login_hint` claim\n  },\n  allowedClientAuthParameters: [\n    'test', \u002F\u002F Can be used with the `login` composable function to provide additional parameters for example a locale for i18n\n  ],\n  validateAccessToken: true,\n  userInfoUrl: 'https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fme', \u002F\u002F Set only if you are sure, you are requesting a Graph API token. This endpoint will not work for custom APIs\u002FApp registrations.\n},",{"id":348,"title":279,"titles":349,"content":350,"level":141},"\u002Fprovider\u002Fentra#environment-variables",[46,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_ENTRA_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_ENTRA_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_ENTRA_AUDIENCE=AUDIENCE # In case you need access to an App\u002FAPI registered in Entra ID\nNUXT_OIDC_PROVIDERS_ENTRA_USER_NAME_CLAIM=given_name\nNUXT_OIDC_PROVIDERS_ENTRA_AUTHORIZATION_URL=https:\u002F\u002Flogin.microsoftonline.com\u002FTENANT_ID\u002Foauth2\u002Fauthorize # For Entra External ID, use https:\u002F\u002FTENANT_NAME.ciamlogin.com\u002FTENANT_ID\u002Foauth2\u002Fauthorize\nNUXT_OIDC_PROVIDERS_ENTRA_TOKEN_URL=https:\u002F\u002Flogin.microsoftonline.com\u002FTENANT_ID\u002Foauth2\u002Ftoken # For Entra External ID, use https:\u002F\u002FTENANT_NAME.ciamlogin.com\u002FTENANT_ID\u002Foauth2\u002Ftoken\nNUXT_OIDC_PROVIDERS_ENTRA_LOGOUT_URL=https:\u002F\u002Flogin.microsoftonline.com\u002FTENANT_ID\u002Foauth2\u002Flogout # For Entra External ID, use https:\u002F\u002FTENANT_NAME.ciamlogin.com\u002FTENANT_ID\u002Foauth2\u002Flogout\nNUXT_OIDC_PROVIDERS_ENTRA_ADDITIONAL_AUTH_PARAMETERS_RESOURCE=RESOURCE_ID # Needs to match the audience\nNUXT_OIDC_PROVIDERS_ENTRA_VALIDATE_ACCESS_TOKEN=true # Adjust based on if you are requesting a custom or a Graph API token. Graph API tokens cannot be decoded and thereby not validated.",{"id":51,"title":50,"titles":352,"content":353,"level":129},[],"GitHub provider documentation",{"id":355,"title":356,"titles":357,"content":358,"level":135},"\u002Fprovider\u002Fgithub#quickstart","Quickstart",[50],"Create an OAuth app in GitHub settings and configure the callback URL as \u003Cyour-domain>\u002Fauth\u002Fgithub\u002Fcallback. The GitHub preset already includes endpoint URLs and provider specific defaults. For a basic login flow, configure only: redirectUriclientIdclientSecret github: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fgithub\u002Fcallback',\n  clientId: '',\n  clientSecret: '',\n}, NUXT_OIDC_PROVIDERS_GITHUB_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_GITHUB_CLIENT_ID=CLIENT_ID If GitHub is your only configured provider, defaultProvider is inferred automatically and \u002Fauth\u002Flogin redirects to \u002Fauth\u002Fgithub\u002Flogin. By default, unauthenticated users are redirected automatically by the global middleware. If you prefer button-only login flow, set oidc.middleware.redirect = false.",{"id":360,"title":260,"titles":361,"content":362,"level":135},"\u002Fprovider\u002Fgithub#featureoidc-support",[50],"❌  PKCE\n❌  Nonce\n✅  State\n❌  Access Token validation\n❌  ID Token validation",{"id":364,"title":10,"titles":365,"content":366,"level":135},"\u002Fprovider\u002Fgithub#introduction",[50],"GitHub is not strictly an OIDC provider, but it can be used as one. Make sure that validation is disabled and that you keep the skipAccessTokenParsing option to true. Try to use a GitHub App, not the legacy OAuth app. They don't provide the same level of security, have no granular permissions, don't provide refresh tokens and are not tested.",{"id":368,"title":274,"titles":369,"content":370,"level":135},"\u002Fprovider\u002Fgithub#example-configuration",[50],"Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via environment variables. github: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fgithub\u002Fcallback',\n  clientId: '',\n  clientSecret: '',\n  filterUserInfo: ['login', 'id', 'avatar_url', 'name', 'email'],\n},",{"id":372,"title":279,"titles":373,"content":374,"level":141},"\u002Fprovider\u002Fgithub#environment-variables",[50,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_GITHUB_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_GITHUB_CLIENT_ID=CLIENT_ID",{"id":55,"title":54,"titles":376,"content":377,"level":129},[],"KeyCloak provider documentation",{"id":379,"title":260,"titles":380,"content":381,"level":135},"\u002Fprovider\u002Fkeycloak#featureoidc-support",[54],"✅  PKCE\n✅  Nonce\n❌  State\n✅  Access Token validation\n❌  ID Token validation",{"id":383,"title":10,"titles":384,"content":385,"level":135},"\u002Fprovider\u002Fkeycloak#introduction",[54],"KeyCloak is an open-source identity and access management solution that provides features like single sign-on (SSO), social login, and user management, making it a popular choice for securing applications. This provider has tested defaults for KeyCloak to offer seamless OpenID Connect (OIDC) authentication with minimal necessary configuration.",{"id":387,"title":388,"titles":389,"content":390,"level":135},"\u002Fprovider\u002Fkeycloak#example-configurations","Example Configurations",[54],"Never store sensitive values like client secrets in your Nuxt config. Inject confidential-client secrets through environment variables.",{"id":392,"title":393,"titles":394,"content":395,"level":141},"\u002Fprovider\u002Fkeycloak#confidential-client","Confidential client",[54,388],"keycloak: {\n  audience: 'account',\n  baseUrl: '',\n  clientId: '',\n  clientSecret: '', \u002F\u002F Set through NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fkeycloak\u002Fcallback',\n}, Keycloak uses authenticationScheme: 'header' by default. Header and body authentication require a non-empty client secret after runtime configuration is resolved.",{"id":397,"title":398,"titles":399,"content":400,"level":141},"\u002Fprovider\u002Fkeycloak#public-client","Public client",[54,388],"Public clients use PKCE without client authentication. Set authenticationScheme: 'none' and omit clientSecret: keycloak: {\n  audience: 'account',\n  authenticationScheme: 'none',\n  baseUrl: '',\n  clientId: '',\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fkeycloak\u002Fcallback',\n},",{"id":402,"title":403,"titles":404,"content":405,"level":141},"\u002Fprovider\u002Fkeycloak#use-logout-url","Use logout url",[54,388],"The to redirect to a specific url after logout, use the logoutRedirectUri configuration.\nYou have to specifically allow a redirect uri, if you want your application to redirect to there after logout: keycloak: {\n  audience: 'account',\n  baseUrl: '',\n  clientId: '',\n  clientSecret: '',\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fkeycloak\u002Fcallback',\n  userNameClaim: 'preferred_username',\n  logoutRedirectUri: 'http:\u002F\u002Flocalhost:3000',  \u002F\u002F Target of your post logout redirection\n}, By default, the following settings are already set internally, but can be overwritten, if needed: logoutUrl: protocol\u002Fopenid-connect\u002Flogout,logoutRedirectParameterName: post_logout_redirect_uri, If you want to use the post logout redirect feature, you should not set exposeIdToken to false, because the ID token is required to hand over to the post logout redirect url.",{"id":407,"title":279,"titles":408,"content":409,"level":141},"\u002Fprovider\u002Fkeycloak#environment-variables",[54,388],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_KEYCLOAK_BASE_URL=http:\u002F\u002Flocalhost:8080\u002Frealms\u002Fnuxt-oidc-test # For local keycloak instance",{"id":411,"title":269,"titles":412,"content":413,"level":135},"\u002Fprovider\u002Fkeycloak#provider-specific-parameters",[54],"Additional parameters to be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters: OptionTypeDefaultDescriptionpromptstring-Optional. This parameter allows to slightly customize the login flow on the KeyCloak server side. For example, enforce displaying the login screen in case of value login.loginHintstring-Optional. Used to pre-fill the username\u002Femail field on the login form.idpHintstring-Optional. Used to tell KeyCloak to skip showing the login page and automatically redirect to the specified identity provider instead.localestring-Optional. Sets the 'ui_locales' query param. For more information on these parameters, check the KeyCloak documentation. Keycloak requires clientId and redirectUri. Confidential clients also require clientSecret. The usual configuration supplies baseUrl, including the realm (for example https:\u002F\u002F\u003Ckeycloak-url>\u002Frealms\u002F\u003Crealm>), so the preset can resolve its relative authorization, token, userinfo, logout, and discovery endpoints. baseUrl can be omitted when every endpoint used by a flow is configured as an absolute URL. Explicit endpoints take precedence over baseUrl; relative explicit endpoints are resolved against it and fail validation when it is absent. For a complete base-less configuration, provide absolute authorizationUrl, tokenUrl, userInfoUrl, logoutUrl, and openIdConfiguration values, or explicitly disable optional userInfoUrl and logoutUrl behavior with empty strings. If you don't want to use the post logout redirect feature of Keycloak, set logoutUrl to ''.\nEnable Client authentication in Keycloak for confidential clients. Leave it disabled for public clients.",{"id":59,"title":58,"titles":415,"content":416,"level":129},[],"Logto provider documentation",{"id":418,"title":260,"titles":419,"content":420,"level":135},"\u002Fprovider\u002Flogto#featureoidc-support",[58],"✅  PKCE\n✅  State\n✅  Nonce\n❌  Access Token validation\n✅  ID Token validation",{"id":422,"title":10,"titles":423,"content":424,"level":135},"\u002Fprovider\u002Flogto#introduction",[58],"Logto is an open-source identity solution that provides authentication and authorization services. The provider is configured with secure defaults and supports all major OIDC security features including PKCE, state, and nonce validation.\nDue to the usage of encrypted access tokens, we are not able to validate access tokens.",{"id":426,"title":274,"titles":427,"content":428,"level":135},"\u002Fprovider\u002Flogto#example-configuration",[58],"Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via. environment variables.",{"id":430,"title":431,"titles":432,"content":433,"level":141},"\u002Fprovider\u002Flogto#minimal","Minimal",[58,274],"logto: {\n  baseUrl: '',\n  clientId: '',\n  clientSecret: '',\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Flogto\u002Fcallback',\n  logoutRedirectUri: 'http:\u002F\u002Flocalhost:3000',\n}",{"id":435,"title":279,"titles":436,"content":437,"level":141},"\u002Fprovider\u002Flogto#environment-variables",[58,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_LOGTO_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_LOGTO_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_LOGTO_BASE_URL=https:\u002F\u002FYOUR_LOGTO_DOMAIN",{"id":439,"title":269,"titles":440,"content":441,"level":135},"\u002Fprovider\u002Flogto#provider-specific-parameters",[58],"The Logto provider supports several specific parameters to customize the authentication experience: OptionTypeDefaultDescriptionfirstScreenstring-Specifies the initial screen shown to users during authentication. This can be used to direct users to specific authentication flows.identifierstring-Defines which identifier types are accepted in the sign-in or sign-up form. This allows you to restrict authentication methods.loginHintstring-Pre-populates the identifier field with a user's email or username. Useful for improving user experience when the identity is known.prompt'login' | 'none' | 'consent' | 'select_account'consentControls the authentication behavior: 'login' forces authentication, 'none' prevents interaction, 'consent' requires explicit consent, and 'select_account' allows account selection. For Logto you have to provide at least the baseUrl, clientId and clientSecret properties. The baseUrl is used to dynamically create the authorizationUrl, tokenUrl, logoutUrl and userInfoUrl.",{"id":63,"title":62,"titles":443,"content":444,"level":129},[],"Microsoft provider documentation",{"id":446,"title":260,"titles":447,"content":262,"level":135},"\u002Fprovider\u002Fmicrosoft#featureoidc-support",[62],{"id":449,"title":10,"titles":450,"content":451,"level":135},"\u002Fprovider\u002Fmicrosoft#introduction",[62],"This is the simplified Microsoft provider for social login with a Microsoft Account (MSA). You need access to the Azure portal (portal.azure.com) to configure an app registration and get the required properties.\nLearn how to creat an app registration here.\nBe sure that you select one of the bottom two options if you want persoanl Microsoft accounts to be able to login to your application: Choose 'Web' as the target platform under Manage -> Authentication -> Platform configurations This provider uses the predefined userInfo url https:\u002F\u002Fgraph.microsoft.com\u002Fv1.0\u002Fme to get user information for an account.",{"id":453,"title":388,"titles":454,"content":428,"level":135},"\u002Fprovider\u002Fmicrosoft#example-configurations",[62],{"id":456,"title":431,"titles":457,"content":458,"level":141},"\u002Fprovider\u002Fmicrosoft#minimal",[62,388],"entra: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fmicrosoft\u002Fcallback',\n  clientId: '',\n  clientSecret: '',\n},",{"id":460,"title":461,"titles":462,"content":463,"level":141},"\u002Fprovider\u002Fmicrosoft#get-user-information","Get user information",[62,388],"You can also add the profile or another OIDC common scope. User.Read as a delegated permission is configured by default in API permissons. entra: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fmicrosoft\u002Fcallback',\n  clientId: '',\n  clientSecret: '',\n  responseType: 'code',\n  scope: ['openid', 'User.Read'],\n},",{"id":465,"title":466,"titles":467,"content":468,"level":141},"\u002Fprovider\u002Fmicrosoft#get-additonal-user-information-with-id-token","Get additonal user information with ID token",[62,388],"To be able to use the ID token, make sure you have set the checkbox at Manage -> Authentication -> Implicit grant and hybrid flows -> ID tokens (used for implicit and hybrid flows).\nTo add additional claims you want to use, configure them on your app registration under Manage -> Token configuration and add them by using the optionalClaims: ['name', 'preferred_username'], parameter.\nThe default setting is optionalClaims: ['name', 'preferred_username'],. entra: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fmicrosoft\u002Fcallback',\n  clientId: '',\n  clientSecret: '',\n  responseType: 'code id_token',\n  scope: ['openid', 'User.Read'],\n},",{"id":470,"title":471,"titles":472,"content":473,"level":141},"\u002Fprovider\u002Fmicrosoft#offline-accessrefresh-token","Offline access\u002Frefresh token",[62,388],"In order to get a refresh token, you need to add the \"Microsoft Graph\" delegated permission offline_access and add it to the scopes.\nManage -> API permissions -> Add a permission entra: {\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fmicrosoft\u002Fcallback',\n  clientId: '',\n  clientSecret: '',\n  responseType: 'code id_token',\n  scope: ['openid', 'User.Read', 'offline_access'],\n},",{"id":475,"title":279,"titles":476,"content":477,"level":141},"\u002Fprovider\u002Fmicrosoft#environment-variables",[62,388],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. NUXT_OIDC_PROVIDERS_MICROSOFT_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_MICROSOFT_CLIENT_ID=CLIENT_ID",{"id":479,"title":269,"titles":480,"content":481,"level":135},"\u002Fprovider\u002Fmicrosoft#provider-specific-parameters",[62],"OptionTypeDefaultDescriptiontenantIdstring-Required. The tenant id is used to automatically configure the correct endpoint urls for the Microsoft provider to work.promptstring'login'Optional. Indicates the type of user interaction that is required. Valid values are login, none, consent, and select_account. Can be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters.loginHintstring-Optional. You can use this parameter to pre-fill the username and email address field of the sign-in page for the user. Apps can use this parameter during reauthentication, after already extracting the login_hint optional claim from an earlier sign-in. Can be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters.logoutHintstring-Optional. Enables sign-out to occur without prompting the user to select an account. To use logout_hint, enable the login_hint optional claim in your client application and use the value of the login_hint optional claim as the logout_hint parameter. Can be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters.domainHintstring-Optional. If included, the app skips the email-based discovery process that user goes through on the sign-in page, leading to a slightly more streamlined user experience. Can be used in additionalAuthParameters, additionalTokenParameters or additionalLogoutParameters.",{"id":67,"title":66,"titles":483,"content":484,"level":129},[],"PayPal provider documentation",{"id":486,"title":260,"titles":487,"content":488,"level":135},"\u002Fprovider\u002Fpaypal#featureoidc-support",[66],"❌  PKCE\n✅  Nonce\n✅  State\n❌  Access Token validation\n❌  ID Token validation",{"id":490,"title":10,"titles":491,"content":492,"level":135},"\u002Fprovider\u002Fpaypal#introduction",[66],"PayPal doesn't support modern security standards like PKCE and is lacking OIDC features like logout redirect functionality.\nThe developer center can be confusing sometimes, make sure to use the correct users for testing and the right credentials. You have to enable the \"Login with PayPal\" functionality first before being able to use PayPal for login:",{"id":494,"title":495,"titles":496,"content":497,"level":141},"\u002Fprovider\u002Fpaypal#scopes","Scopes",[66,10],"By default the PayPal provider used the openid scope. If you need more use information, you can add standard OIDC scopes (like profile or email) or custom PayPal ones like https:\u002F\u002Furi.paypal.com\u002Fservices\u002Fpaypalattributes.\nBefore adding additional scopes, make sure you have checked at least one of the following checkboxes.",{"id":499,"title":500,"titles":501,"content":502,"level":141},"\u002Fprovider\u002Fpaypal#sandbox","Sandbox",[66,10],"For testing, PayPal provides test accounts and endpoints that are separate from PayPals production infrastructure. For testing use the account with type Personal from Testing Tools -> Sandbox Accounts. Trying to use a business account will always fail to retrieve information from the userinfo endpoint. This is unfortunately undocumented.",{"id":504,"title":269,"titles":505,"content":271,"level":135},"\u002Fprovider\u002Fpaypal#provider-specific-parameters",[66],{"id":507,"title":274,"titles":508,"content":509,"level":135},"\u002Fprovider\u002Fpaypal#example-configuration",[66],"Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via. environment variables. paypal: {\n  clientId: '',\n  clientSecret: '',\n  scope: ['openid', 'profile'],\n  authorizationUrl: 'https:\u002F\u002Fwww.sandbox.paypal.com\u002Fsignin\u002Fauthorize?flowEntry=static', \u002F\u002F Replace depending on sandbox or production environment\n  tokenUrl: 'https:\u002F\u002Fapi-m.sandbox.paypal.com\u002Fv1\u002Foauth2\u002Ftoken', \u002F\u002F Replace depending on sandbox or production environment\n  userInfoUrl: 'https:\u002F\u002Fapi-m.sandbox.paypal.com\u002Fv1\u002Fidentity\u002Fopenidconnect\u002Fuserinfo?schema=openid', \u002F\u002F Replace depending on sandbox or production environment\n  redirectUri: 'http:\u002F\u002F127.0.0.1:3000\u002Fauth\u002Fpaypal\u002Fcallback', \u002F\u002F PayPal doesn't support localhost for http, only 127.0.0.1\n},",{"id":511,"title":279,"titles":512,"content":513,"level":141},"\u002Fprovider\u002Fpaypal#environment-variables",[66,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. PayPal only supports IPs for local development, so you have to set the redirectUri to 127.0.0.1 and set Nuxt to expose on that address via. the .env HOST entry. # Only enable the HOST entry when testing PAYPAL\nHOST=127.0.0.1\nNUXT_OIDC_PROVIDERS_PAYPAL_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_PAYPAL_CLIENT_SECRET=CLIENT_SECRET",{"id":71,"title":70,"titles":515,"content":516,"level":129},[],"Generic OIDC provider documentation",{"id":518,"title":10,"titles":519,"content":520,"level":135},"\u002Fprovider\u002Foidc#introduction",[70],"This is a generic OIDC provider that doesn't provide any preconfiguration or helpers to automatically generate URL.\nIf your provider is not listed, you should be able to configure it with this provider. This is the generic providers default configuration: const defaults: Partial\u003COidcProviderConfig> = {\n  clientId: '',\n  redirectUri: '',\n  clientSecret: '',\n  authorizationUrl: '',\n  tokenUrl: '',\n  responseType: 'code',\n  authenticationScheme: 'header',\n  grantType: 'authorization_code',\n  pkce: false,\n  state: true,\n  nonce: false,\n  scope: ['openid'],\n  scopeInTokenRequest: false,\n  tokenRequestType: 'form',\n  requiredProperties: [\n    'clientId',\n    'redirectUri',\n    'clientSecret',\n    'authorizationUrl',\n    'tokenUrl',\n  ],\n  validateAccessToken: true,\n  validateIdToken: true,\n  skipAccessTokenParsing: false,\n  exposeAccessToken: false,\n  exposeIdToken: false,\n  callbackRedirectUrl: '\u002F',\n  allowedClientAuthParameters: undefined,\n  logoutUrl: '',\n  sessionConfiguration: undefined,\n  additionalAuthParameters: undefined,\n  additionalTokenParameters: undefined,\n  additionalLogoutParameters: undefined,\n  excludeOfflineScopeFromTokenRequest: false,\n}",{"id":522,"title":274,"titles":523,"content":524,"level":135},"\u002Fprovider\u002Foidc#example-configuration",[70],"Never store sensitive values like your client secret in your Nuxt config. Our recommendation is to inject at least client id and client secret via. environment variables. oidc: {\n  clientId: '',\n  clientSecret: '',\n  responseType: 'code id_token',\n  validateAccessToken: false,\n  validateIdToken: false,\n  skipAccessTokenParsing: true,\n  state: true,\n  nonce: true,\n  pkce: true,\n  tokenRequestType: 'form-urlencoded',\n  scope: ['openid', 'email'],\n  authorizationUrl: '',\n  tokenUrl: '',\n  userInfoUrl: '',\n  redirectUri: '',\n},",{"id":526,"title":279,"titles":527,"content":528,"level":141},"\u002Fprovider\u002Foidc#environment-variables",[70,274],"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production. EVERY AVAILABLE PARAMETER",{"id":82,"title":81,"titles":530,"content":531,"level":129},[],"Nuxt middleware integration",{"id":533,"title":81,"titles":534,"content":535,"level":135},"\u002Fserver-utils\u002Fmiddleware#middleware",[81],"This module can automatically add a global middleware to your Nuxt server. You can enable it by setting globalMiddlewareEnabled under the middleware section of the config.\nThe middleware automatically redirects all requests to \u002Fauth\u002Flogin if the user is not logged in and forwards the originally requested URL as callbackRedirectUrl. You can disable this behavior by setting redirect to false in the middleware configuration.\nAfter a successful callback, the user is redirected back to this original URL unless providers.\u003Cprovider>.callbackRedirectUrl is explicitly configured. In that case, the configured callback redirect takes precedence.\nThe \u002Fauth\u002Flogin route is only configured if you have defined a default provider. If you want to use a custom login page and keep your default provider or don't want to set a default provider at all, you can set customLoginPage to true in the middleware configuration. If you set customLoginPage to true, you have to manually add a login page to your Nuxt app under \u002Fauth\u002Flogin. You can use the login method from the useOidcAuth composable to redirect the user to the respective provider login page.\nSetting customLogoutPage to true will disable the \u002Fauth\u002Flogout route. This route, if a default provider is set, redirects to the default providers logout page (\u002Fauth\u002F\u003Cprovider>\u002Flogout). You have to manually add a logout page to your Nuxt app under \u002Fauth\u002Flogout and use the logout method from the useOidcAuth composable to logout the user or make sure that you always provide the optional provider parameter to the logout method. \u003Cscript setup>\nconst { logout, currentProvider } = useOidcAuth()\n\u003C\u002Fscript>\n\n\u003Ctemplate>\n  \u003Cbutton @click=\"logout(currentProvider)\">\n    Logout\n  \u003C\u002Fbutton>\n\u003C\u002Ftemplate> Everything under the \u002Fauth path is not protected by the global middleware. Make sure to not use this path for any other purpose than authentication.",{"id":86,"title":85,"titles":537,"content":538,"level":129},[],"Nuxt session management",{"id":540,"title":541,"titles":542,"content":543,"level":135},"\u002Fserver-utils\u002Fsession-management#session-expiration-and-refresh","Session expiration and refresh",[85],"Nuxt OIDC Auth automatically checks if the session is expired and refreshes it if necessary. You can disable this behavior by setting expirationCheck and automaticRefresh to false in the session configuration.\nThe session is automatically refreshed when the session object is accessed. You can also manually refresh the session using refresh from useOidcAuth on the client or on the server side by calling refreshUserSession(event). Session expiration and refresh is handled completely server side, the exposed properties in the user session are automatically updated. You can theoretically register a hook that overwrites session fields like loggedInAt, but this is not recommended and will be overwritten with each refresh.",{"id":545,"title":546,"titles":547,"content":548,"level":135},"\u002Fserver-utils\u002Fsession-management#using-the-session-in-server-side-code","Using the session in server side code",[85],"You can access the user session in your server side code by using the getUserSession function from nuxt-oidc-auth. import { getUserSession } from 'nuxt-oidc-auth\u002Fruntime\u002Fserver\u002Futils\u002Fsession.js'\n\nexport default eventHandler(async (event) => {\n  const session = await getUserSession(event)\n  return session.userName\n}) By default, getUserSession and refreshUserSession throw an HTTP 401 when the session is invalid or expired and cannot be refreshed. For API\u002FXHR handlers, you can explicitly choose error behavior: import { getUserSession } from 'nuxt-oidc-auth\u002Fruntime\u002Fserver\u002Futils\u002Fsession.js'\n\nexport default eventHandler(async (event) => {\n  const session = await getUserSession(event, { errorBehavior: 'throw' })\n  return { user: session.userName }\n}) Use { errorBehavior: 'redirect' } when you want legacy redirect behavior instead of an HTTP error. Be careful to not expose any sensitive information from the handler code.",{"id":90,"title":89,"titles":550,"content":551,"level":129},[],"Nuxt OIDC Auth route handlers",{"id":553,"title":554,"titles":555,"content":556,"level":135},"\u002Fserver-utils\u002Foidc-handlers#oidc-event-handlers","OIDC Event Handlers",[89],"All configured providers automatically register the following server routes. \u002Fauth\u002F\u003Cprovider>\u002Fcallback\u002Fauth\u002F\u003Cprovider>\u002Flogin\u002Fauth\u002F\u003Cprovider>\u002Flogout In addition, if defaultProvider is set, the following route rules are registered as forwards to the default provider. \u002Fauth\u002Flogin\u002Fauth\u002Flogout",{"id":558,"title":546,"titles":559,"content":560,"level":141},"\u002Fserver-utils\u002Foidc-handlers#using-the-session-in-server-side-code",[89,554],"You can access the user session in your server side code by using the getUserSession function from the nuxt-oidc-auth module. import { getUserSession } from 'nuxt-oidc-auth\u002Fruntime\u002Fserver\u002Futils\u002Fsession.js'\n\nexport default eventHandler(async (event) => {\n  const session = await getUserSession(event, { errorBehavior: 'throw' })\n  return session.userName\n}) Use { errorBehavior: 'redirect' } if you want to redirect to \u002F on auth\u002Fsession errors. Be careful to not expose any sensitive information from the handler code.",{"id":94,"title":93,"titles":562,"content":563,"level":129},[],"Use the useOidcAuth composable to interact with authentication state",{"id":565,"title":10,"titles":566,"content":567,"level":135},"\u002Fcomposable#introduction",[93],"Nuxt OIDC Auth automatically adds API routes to interact with the current user session and auto imports the useOidcAuth composable, which provides the following properties and methods to access the user session from your Vue components or middlewares: loginlogoutloggedInusercurrentProviderfetchrefresh",{"id":569,"title":570,"titles":571,"content":572,"level":135},"\u002Fcomposable#login","login",[93],"Call login to initiate the login process. It can be used in a route middleware as well as in components and should always be used instead of manually forwarding to \u002Fauth\u002FPROVIDER\u002Flogin or \u002Fauth\u002Flogin. Example usage: \u003Cscript setup lang=\"ts\">\nconst { loggedIn, user, login, logout } = useOidcAuth()\n\u003C\u002Fscript>\n\n\u003Ctemplate>\n  \u003Cdiv v-if=\"loggedIn\">\n    \u003Ch1>Welcome {{ user.userName }}!\u003C\u002Fh1>\n    \u003Cp>Logged in since {{ user.loggedInAt }}\u003C\u002Fp>\n    \u003Cbutton @click=\"logout()\">\n      Logout\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n  \u003Cdiv v-else>\n    \u003Ch1>Not logged in\u003C\u002Fh1>\n    \u003Cbutton @click=\"login()\">\n      Login with default provider\n    \u003C\u002Fbutton>\n  \u003C\u002Fdiv>\n\u003C\u002Ftemplate>",{"id":574,"title":575,"titles":576,"content":577,"level":141},"\u002Fcomposable#parameters","Parameters",[93,570],"login takes the following parameters NameDescriptionTypeRequiredproviderThe authentication provider to use. If not specified, uses the default provider.string (needs to be a configured provider)NoparamsAdditional parameters to include in the login request. Parameters must be listed in allowedClientAuthParameters in the provider configuration, except callbackRedirectUrl which is handled by the module and can be used to return to a local path after callback.Record\u003Cstring, string>No",{"id":579,"title":580,"titles":581,"content":582,"level":141},"\u002Fcomposable#returns","Returns",[93,570],"Promise (does not have to be awaited)",{"id":584,"title":585,"titles":586,"content":587,"level":135},"\u002Fcomposable#logout","logout",[93],"Handles the logout process. Always provide the optional provider parameter if you haven't set a default provider. You can get the current provider from the currentProvider property. Example usage: \u003Cscript setup lang=\"ts\">\nconst { logout } = useOidcAuth()\n\u003C\u002Fscript>\n\n\u003Ctemplate>\n  \u003Cbutton @click=\"logout()\">\n    Logout\n  \u003C\u002Fbutton>\n\u003C\u002Ftemplate> Example usage with no default provider configured or middleware => customLoginPage set to true: \u003Cscript setup lang=\"ts\">\nconst { logout, currentProvider } = useOidcAuth()\n\u003C\u002Fscript>\n\n\u003Ctemplate>\n  \u003Cbutton @click=\"logout(currentProvider)\">\n    Logout\n  \u003C\u002Fbutton>\n\u003C\u002Ftemplate>",{"id":589,"title":575,"titles":590,"content":591,"level":141},"\u002Fcomposable#parameters-1",[93,585],"logout takes the following parameters NameDescriptionTypeRequiredproviderThe authentication provider to use. If not specified, uses the default provider.string (needs to be a configured provider)NologoutRedirectUriThe URI to redirect to after logout if logoutRedirectParameterName is set. If not provided, the user will be redirected to the root site.Record\u003Cstring, string>No",{"id":593,"title":580,"titles":594,"content":595,"level":141},"\u002Fcomposable#returns-1",[93,585],"Promise (can be awaited)",{"id":597,"title":598,"titles":599,"content":600,"level":135},"\u002Fcomposable#loggedin","loggedIn",[93],"Use loggedIn to check if the user is currently logged in. Example usage: const { loggedIn } = useOidcAuth()\n\nif (loggedIn.value) {\n  console.log('User is logged in')\n}\nelse {\n  console.log('User is not logged in')\n}",{"id":602,"title":575,"titles":603,"content":604,"level":141},"\u002Fcomposable#parameters-2",[93,598],"login takes the following parameters NameDescriptionRequiredproviderThe authentication provider to use. If not specified, uses the default provider.NoparamsAdditional parameters to include in the login request. Each parameters has to be listed in allowedClientAuthParameters in the provider configuration.No",{"id":606,"title":580,"titles":607,"content":582,"level":141},"\u002Fcomposable#returns-2",[93,598],{"id":609,"title":610,"titles":611,"content":612,"level":135},"\u002Fcomposable#user","user",[93],"The current user object ref. See User object",{"id":614,"title":615,"titles":616,"content":617,"level":135},"\u002Fcomposable#currentprovider","currentProvider",[93],"The name of the currently logged in provider. Example usage: \u003Cscript setup lang=\"ts\">\nconst { logout, currentProvider } = useOidcAuth()\n\u003C\u002Fscript>\n\n\u003Ctemplate>\n  \u003Cbutton @click=\"logout(currentProvider)\">\n    Logout\n  \u003C\u002Fbutton>\n\u003C\u002Ftemplate>",{"id":619,"title":620,"titles":621,"content":622,"level":135},"\u002Fcomposable#fetch","fetch",[93],"Fetches\u002Fupdates the current user session from the server. Only refreshed the session if the session is expired. Mainly used in middleware or plugins to make ensure there is a session.",{"id":624,"title":575,"titles":625,"content":626,"level":141},"\u002Fcomposable#parameters-3",[93,620],"fetch takes no additional parameters.",{"id":628,"title":580,"titles":629,"content":595,"level":141},"\u002Fcomposable#returns-3",[93,620],{"id":631,"title":632,"titles":633,"content":634,"level":135},"\u002Fcomposable#refresh","refresh",[93],"Refreshes the current user session against the used provider to get a new access token. Only available if the current provider issued a refresh token (indicated by canRefresh property in the user object). Example usage: \u003Cscript setup lang=\"ts\">\nconst { loggedIn, user, refresh } = useOidcAuth()\nconst refreshing = ref(false)\nasync function handleRefresh() {\n  refreshing.value = true\n  await refresh()\n  refreshing.value = false\n}\n\u003C\u002Fscript>\n\n\u003Ctemplate>\n  \u003Cbutton\n    class=\"btn-base btn-login\"\n    :disabled=\"!loggedIn || !user?.canRefresh || refreshing\"\n    @click=\"handleRefresh()\"\n  >\n    \u003Cspan class=\"i-majesticons-refresh\" \u002F>\n    \u003Cspan class=\"pl-2\">Refresh\u003C\u002Fspan>\n  \u003C\u002Fbutton>\n\u003C\u002Ftemplate>",{"id":636,"title":575,"titles":637,"content":638,"level":141},"\u002Fcomposable#parameters-4",[93,632],"refresh takes no additional parameters.",{"id":640,"title":580,"titles":641,"content":642,"level":141},"\u002Fcomposable#returns-4",[93,632],"Promise (should be awaited)",{"id":644,"title":645,"titles":646,"content":647,"level":135},"\u002Fcomposable#user-object","User object",[93],"The user object provided by useOidcAuth contains the following properties: NameTypeDescriptionproviderstringName of the provider used to log in the current sessioncanRefreshbooleanWhether the current session exposed a refresh tokenloggedInAtnumberLogin timestamp in second precisionupdatedAtnumberRefresh timestamp in second precisionexpireAtnumberSession expiration timestamp in second precision. Either loggedInAt plus session max age or expiration of access token if available.userInfoRecord\u003Cstring, unknown>Additional information coming from the provider's userinfo endpointuserNamestringComing either from the provider or from the configured mapped claimclaimsRecord\u003Cstring, unknown>Additional optional claims from the id token, if optionalClaims setting is configured.accessTokenstringExposed access token, only existent when exposeAccessToken is configured.idTokenstringExposed access token, only existent when exposeIdToken is configured. You can extend the type for your provider info by creating a type declaration file (for example, auth.d.ts) in your project: declare module '#oidc-auth' {\n  interface UserSession {\n    \u002F\u002F define custom claim object\n    claims: {\n      customProviderToken: string\n    }\n  }\n}",{"id":98,"title":97,"titles":649,"content":650,"level":129},[],"Development mode for seamless local development",{"id":652,"title":97,"titles":653,"content":654,"level":135},"\u002Fdev-mode#dev-mode",[97],"Since 0.10.0, there is a local dev mode available. It can only be enabled when NODE_ENV does not start with prod, case-insensitively, and dev mode is explicitly enabled in config. The dev mode is for local and offline development and returns a static user object that can be configured in config or by variables in .env. The following fields in the returned user object can be configured: claims: devMode.claims settinguserName: devMode.userName settinguserInfo: devMode.userInfo settingidToken: devMode.idToken settingaccessToken: devMode.accessToken setting Please refer to user object for required types.",{"id":656,"title":657,"titles":658,"content":659,"level":141},"\u002Fdev-mode#enabling","Enabling",[97,97],"Enable dev mode in the oidc section of nuxt.config.ts: export default defineNuxtConfig({\n  oidc: {\n    devMode: {\n      enabled: true,\n    },\n  },\n}) Dev sessions bypass provider token-expiration and persistent-token checks, so global session.expirationCheck can keep its default value.",{"id":661,"title":662,"titles":663,"content":664,"level":141},"\u002Fdev-mode#configuration-options","Configuration Options",[97,97],"OptionTypeDefaultDescriptionenabledbooleanfalseEnables\u002Fdisables dev mode. Ignored when NODE_ENV starts with prod, case-insensitively.userNamestring'Nuxt OIDC Auth Dev'Sets the userName field on the user object.userInfoRecord\u003Cstring, unknown>-Sets the userInfo field on the user object.claimsRecord\u003Cstring, string>-Sets the claims field on the user object and generated JWT token.idTokenstring-Sets the idToken field on the user object.accessTokenstring-Sets the accessToken field on the user object (overridden if generateAccessToken is true).generateAccessTokenbooleanfalseIf set, generates a signed JWT token for the accessToken field.tokenAlgorithm'symmetric' | 'asymmetric''asymmetric'Algorithm for signing generated tokens. Asymmetric uses RS256, symmetric uses HS256.issuerstring'nuxt:oidc:auth:issuer'Sets the iss claim on the generated JWT token.audiencestring'nuxt:oidc:auth:audience'Sets the aud claim on the generated JWT token.subjectstring'nuxt:oidc:auth:subject'Sets the sub claim on the generated JWT token.",{"id":666,"title":667,"titles":668,"content":669,"level":141},"\u002Fdev-mode#token-generation","Token Generation",[97,97],"If needed, the dev mode can generate a valid signed access token if the setting devMode -> generateAccessToken is set to true. This token will be exposed in the user.accessToken property. The properties on the generated token are: iat (issued at): current DateTimeiss (issuer): devMode.issuer setting, default nuxt:oidc:auth:issueraud (audience): devMode.audience setting, default nuxt:oidc:auth:audiencesub (subject): devMode.subject setting, default nuxt:oidc:auth:subjectexp (expiration): current DateTime + 24hkid (key ID): included in JWT header when using asymmetric algorithm",{"id":671,"title":672,"titles":673,"content":674,"level":675},"\u002Fdev-mode#token-algorithm","Token Algorithm",[97,97,667],"The tokenAlgorithm option controls how tokens are signed: asymmetric (default): Uses RS256 algorithm with an RSA key pair. The public key is exposed via the JWKS endpoint, allowing token verification.symmetric: Uses HS256 algorithm with a random secret. The JWKS endpoint returns an empty keys array since symmetric secrets should not be exposed.",4,{"id":677,"title":678,"titles":679,"content":680,"level":141},"\u002Fdev-mode#oidc-discovery-endpoints","OIDC Discovery Endpoints",[97,97],"When dev mode is enabled with generateAccessToken: true and tokenAlgorithm: 'asymmetric' (the default), the module exposes OIDC-compliant discovery endpoints that allow token verification:",{"id":682,"title":683,"titles":684,"content":685,"level":675},"\u002Fdev-mode#discovery-endpoint","Discovery Endpoint",[97,97,678],"\u002Fauth\u002Fdev\u002F.well-known\u002Fopenid-configuration Returns a JSON document containing: {\n  \"issuer\": \"nuxt:oidc:auth:issuer\",\n  \"jwks_uri\": \"http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fdev\u002F.well-known\u002Fjwks.json\"\n} The issuer value matches your configured devMode.issuer setting.",{"id":687,"title":688,"titles":689,"content":690,"level":675},"\u002Fdev-mode#jwks-endpoint","JWKS Endpoint",[97,97,678],"\u002Fauth\u002Fdev\u002F.well-known\u002Fjwks.json Returns the public key in JWKS format for token verification: {\n  \"keys\": [\n    {\n      \"kty\": \"RSA\",\n      \"n\": \"...\",\n      \"e\": \"AQAB\",\n      \"kid\": \"dev-...\",\n      \"alg\": \"RS256\",\n      \"use\": \"sig\"\n    }\n  ]\n} When tokenAlgorithm is set to symmetric, the endpoint returns { \"keys\": [] }.",{"id":692,"title":693,"titles":694,"content":695,"level":675},"\u002Fdev-mode#key-persistence","Key Persistence",[97,97,678],"The RSA key pair used for signing tokens is: Generated on first use and stored in .nuxt\u002Foidc-devPersisted across hot module reloads (HMR)Regenerated on cold server start (full restart) This ensures tokens remain verifiable during a development session while preventing key reuse across server restarts. Dev mode is intended for local development and testing only. The generated keys and tokens should not be considered secure for production use. Never configure dev mode on production systems.",{"id":102,"title":101,"titles":697,"content":698,"level":129},[],"Cross tab and browser sign out and server side session invalidation",{"id":700,"title":101,"titles":701,"content":702,"level":135},"\u002Fsingle-sign-out#single-sign-out",[101],"Single sign-out is a feature that allows users to sign out of the application in one tab\u002Fbrowser and have the same user session invalidated in other tabs\u002Fbrowsers. This is useful for compliance purposes, as it ensures that if a user signs out of the application, the session will be invalidated across all devices. There are still cases where the session is still usable, as the user can theoretically block the connection to the server endpoint. The server side session will still be invalidated, but the session data will stay in the browser until the session expires or the user fetches or refreshes the session.",{"id":704,"title":705,"titles":706,"content":707,"level":135},"\u002Fsingle-sign-out#how-it-works","How it works",[101],"Single sign-out registers a plugin in the client that subscribes to a server sent event endpoint on the server. This endpoint is used to send a message to the client when the user signs out in a different tab\u002Fbrowser. The feature uses a unique session ID to track related sessions across tabs\u002Fbrowsers. When a user signs out: The user logs outThe server invalidates the sessionA message is broadcast to all connected clients with the same session IDClients receiving the message log out as wellWhen a user reconnects with an old session, the plugin will automatically invalidate sessions that may still be active in the browser If there is no refresh token, meaning there is no persistent session, single sign-out will only work in the same browser and with the same session.",{"id":709,"title":710,"titles":711,"content":712,"level":141},"\u002Fsingle-sign-out#event-stream-authorization","Event stream authorization",[101,705],"The \u002Fapi\u002F_auth\u002Fsso event stream accepts only a valid sealed session cookie for a configured provider whose current session has singleSignOut: true. With expiration checks enabled, definitively expired non-refreshable sessions receive 401; sessions with expiration checks disabled, or expired refreshable sessions with automatic refresh enabled, continue through normal session handling. Refreshable sessions must also satisfy the configured missing-persistent-session policy. Invalid or otherwise ineligible requests receive 401 before an event stream is opened. Local session-error and logout redirects include Nuxt's configured app.baseURL. For example, an application mounted at \u002Fportal\u002F returns to \u002Fportal\u002F rather than the origin root.",{"id":714,"title":715,"titles":716,"content":717,"level":135},"\u002Fsingle-sign-out#configuration","Configuration",[101],"Example configuration in nuxt.config.ts with Keycloak provider: keycloak: {\n        baseUrl: '',\n        clientId: '',\n        clientSecret: '',\n        redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fkeycloak\u002Fcallback',\n        userNameClaim: 'preferred_username',\n        logoutRedirectUri: 'http:\u002F\u002Flocalhost:3000',\n        \u002F\u002F Single sign-out\n        sessionConfiguration: {\n          singleSignOut: true,\n          singleSignOutIdField: 'sub',\n        },\n      },",{"id":719,"title":720,"titles":721,"content":722,"level":141},"\u002Fsingle-sign-out#options","Options",[101,715],"OptionTypeDefaultDescriptionsingleSignOutbooleanfalseEnable single sign-out across tabssingleSignOutIdField'sub' | 'aud''sub'Token field for session ID",{"id":724,"title":725,"titles":726,"content":727,"level":135},"\u002Fsingle-sign-out#provider-support","Provider Support",[101],"Single sign-out is supported by all providers that issue refresh tokens. The feature requires a persistent session to work across browsers.",{"id":106,"title":105,"titles":729,"content":730,"level":129},[],"Nuxt hooks to interact with nuxt-oidc-auth",{"id":732,"title":105,"titles":733,"content":734,"level":135},"\u002Fhooks#hooks",[105],"The following hooks are available to extend the default behavior of the OIDC module: fetch (Called when a user session is fetched)clear (Called before a user session is cleared)refresh (Called before a user session is refreshed) Remember to also update the refresh hook if you modify the session, as claims and other fields would otherwise be wiped.",{"id":736,"title":737,"titles":738,"content":739,"level":675},"\u002Fhooks#example","Example",[105,105],"export default defineNitroPlugin(() => {\n  sessionHooks.hook('fetch', async (session) => {\n    \u002F\u002F Extend User Session\n    \u002F\u002F Or throw createError({ ... }) if session is invalid\n    \u002F\u002F session.extended = {\n    \u002F\u002F   fromHooks: true\n    \u002F\u002F }\n    console.log('Injecting \"status\" claim as test')\n    if (!(Object.keys(session).length === 0)) {\n      const claimToAdd = { status: 'Fetch' }\n      session.claims = { ...session.claims, ...claimToAdd }\n    }\n  })\n\n  sessionHooks.hook('refresh', async (session) => {\n    console.log('Injecting \"status\" claim as test on refresh')\n    if (!(Object.keys(session).length === 0)) {\n      const claimToAdd = { status: 'Refresh' }\n      session.claims = { ...session.claims, ...claimToAdd }\n    }\n  })\n\n  sessionHooks.hook('clear', async (session) => {\n    \u002F\u002F Log that user logged out\n    console.log('User logged out')\n  })\n}) You can theoretically register a hook that overwrites internal session fields like loggedInAt, but this is not recommended as it has an impact on the loggedIn state of your session. It will not impact the server side refresh and expiration logic, but will be overwritten with each refresh.",{"id":110,"title":109,"titles":741,"content":742,"level":129},[],"Configuration reference for nuxt-oidc-auth",{"id":744,"title":109,"titles":745,"content":746,"level":135},"\u002Fconfiguration#configuration-reference",[109],"The configuration for this module can be defined in your nuxt.config.ts file: export default defineNuxtConfig({\n  oidc: {\n    defaultProvider: '\u003Cprovider>',\n    providers: {\n      \u003Cprovider>: {\n        clientId: '...',\n        clientSecret: '...'\n      }\n    },\n    middleware: {\n      globalMiddlewareEnabled: true,\n      customLoginPage: false\n    }\n  }\n})",{"id":748,"title":749,"titles":750,"content":751,"level":135},"\u002Fconfiguration#global-configuration-oidc","Global configuration (oidc)",[109],"OptionTypeDefaultDescriptionenabledbooleantrueEnables\u002Fdisables the moduledefaultProviderProviderKeysundefinedSets the default provider. Enables automatic registration of generic \u002Fauth\u002Flogin and \u002Fauth\u002Flogout route rulesprovidersPartial\u003CProviderConfigs>{}Configuration entries for each configured provider. For provider specific config see Provider specific configurationssessionOmit\u003CAuthSessionConfig, 'singleSignOutIdField' | 'singleSignOut'>Global session configurationOptional global session configurationmiddlewareMiddlewareConfigMiddleware configurationOptional middleware specific configurationdevModeDevModeConfigDev Mode configurationConfiguration for local dev modedevtoolsbooleantrueEnables\u002Fdisables Nuxt DevTools integration for this moduleprovideDefaultSecretsbooleantrueProvide defaults for NUXT_OIDC_SESSION_SECRET, NUXT_OIDC_TOKEN_KEY and NUXT_OIDC_AUTH_SESSION_SECRET using a Nitro plugin. Turning this off can lead to the app not working if no secrets are provided",{"id":753,"title":754,"titles":755,"content":756,"level":141},"\u002Fconfiguration#provider-configuration-provider","Provider Configuration (provider)",[109,749],"\u003Cprovider> OptionTypeDefaultDescriptionclientIdstring''Client IDclientSecretstring''Client secret. Required for header and body authentication; omitted for none.responseType'code' | 'code token' | 'code id_token' | 'id_token token' | 'code id_token token' (optional)codeResponse TypeauthenticationScheme'header' | 'body' | 'none' (optional)headerToken endpoint client authentication scheme. Use none for public clients.responseMode'query' | 'fragment' | 'form_post' | string (optional)-Response mode for authentication requestauthorizationUrlstring (optional)''Authorization endpoint URLtokenUrlstring (optional)''Token endpoint URLuserInfoUrlstring (optional)''Userinfo endpoint URLredirectUristring (optional)''Redirect URIgrantType'authorization_code' | 'refresh_token' (optional)authorization_codeGrant Typescopestring[] (optional)['openid']Scopepkceboolean (optional)falseUse PKCE (Proof Key for Code Exchange)stateboolean (optional)trueUse state parameter with a random value. If state is not used, the nonce parameter is used to identify the flow.nonceboolean (optional)falseUse nonce parameter with a random value.userNameClaimstring (optional)''User name claim that is used to get the user name from the access token as a fallback in case the userinfo endpoint is not provided or the userinfo request fails.optionalClaimsstring[] (optional)[]Claims to be extracted from the id tokenlogoutUrlstring (optional)''Logout endpoint URLlogoutRedirectUristring (optional)undefinedRedirect URI appended to the logout endpoint if configuredscopeInTokenRequestboolean (optional)falseInclude scope in token requesttokenRequestType'form' | 'form-urlencoded' | 'json' (optional)'form'Token request typeaudiencestring (optional)-Audience used for token validation (not included in requests by default, use additionalTokenParameters or additionalAuthParameters to add it)requiredPropertiesstring[]['clientId', 'redirectUri', 'clientSecret', 'authorizationUrl', 'tokenUrl']Required properties validated after runtime resolution. clientSecret is ignored only when authenticationScheme is none.filterUserInfostring[] (optional)undefinedFilter userinfo response to only include these properties.skipAccessTokenParsingboolean (optional)falseSkip access token parsing (for providers that don't follow the OIDC spec\u002Fdon't issue JWT access tokens).logoutRedirectParameterNamestring (optional)''Query parameter name for logout redirect. Will be appended to the logoutUrl as a query parameter.additionalAuthParametersRecord\u003Cstring, string> (optional)undefinedAdditional parameters to be added to the authorization request. See Provider specific configurations for possible parameters.additionalTokenParametersRecord\u003Cstring, string> (optional)undefinedAdditional parameters to be added to the token request. See Provider specific configurations for possible parameters.additionalLogoutParametersRecord\u003Cstring, string> (optional)undefinedAdditional parameters to be added to the logout request. See Provider specific configurations for possible parameters.baseUrlstring (optional)''Provider Only. Base URL for the provider, used when to dynamically create authorizationUrl, tokenUrl, userInfoUrl and logoutUrl if possible.openIdConfigurationstring, Record\u003Cstring, unknown>, or function (config) => Promise\u003CRecord\u003Cstring, unknown>> (optional)undefinedOpenID Configuration URL, object, or function that resolves to an OpenID Configuration object.validateAccessTokenboolean (optional)trueValidate access token.validateIdTokenboolean (optional)trueValidate id token.tokenValidationMode'legacy' | 'strict' (optional)'legacy'strict validates every enabled JWT in callback and refresh token responses with token-specific audience, issuer, signature, and expiration checks. Strict access-token validation requires audience; any enabled strict validation requires OpenID discovery metadata with issuer and jwks_uri.encodeRedirectUriboolean (optional)falseEncode redirect uri query parameter in authorization request. Only for compatibility with services that don't implement proper parsing of query parameters.exposeAccessTokenboolean (optional)falseExpose access token to the client within session objectexposeIdTokenboolean (optional)falseExpose raw id token to the client within session objectcallbackRedirectUrlstring (optional)\u002FSet a custom redirect url after a successful callback. If explicitly configured, it takes precedence over middleware-provided callbackRedirectUrl valuesallowedCallbackRedirectUrlsstring[] (optional)[]Allowlist for redirect query parameters used on callback routesallowedClientAuthParametersstring[] (optional)[]List of allowed client-side user-added query parameters for the auth requestproxystring (optional)undefinedProxy URL used for outbound requests to this providerignoreProxyCertificateErrorsboolean (optional)falseDisable proxy certificate validation (development only, insecure for production)sessionConfigurationProviderSessionConfig (optional){}Session configuration overrides, see session",{"id":758,"title":759,"titles":760,"content":761,"level":141},"\u002Fconfiguration#runtime-environment-overrides","Runtime environment overrides",[109,749],"Every serializable provider option can be supplied through Nuxt runtime environment variables, including options omitted from nuxt.config.ts. Nested provider session fields and provider-declared additional parameters follow Nuxt's uppercase underscore naming; record and list values can also use JSON: NUXT_OIDC_PROVIDERS_KEYCLOAK_CLIENT_ID=web-client\nNUXT_OIDC_PROVIDERS_KEYCLOAK_SESSION_CONFIGURATION_MAX_AUTH_SESSION_AGE=180\nNUXT_OIDC_PROVIDERS_KEYCLOAK_OPEN_ID_CONFIGURATION=https:\u002F\u002Fid.example.com\u002Frealms\u002Fapp\u002F.well-known\u002Fopenid-configuration\nNUXT_OIDC_PROVIDERS_OIDC_ADDITIONAL_AUTH_PARAMETERS={\"prompt\":\"consent\"} Runtime environment values take precedence over values from nuxt.config.ts and provider defaults. Functions are not serializable runtime inputs; configure openIdConfiguration as a URL when it must be changed at deployment time.",{"id":763,"title":764,"titles":765,"content":766,"level":141},"\u002Fconfiguration#endpoint-resolution-and-validation","Endpoint resolution and validation",[109,749],"An explicitly configured endpoint takes precedence over the provider preset and baseUrl. Absolute http or https endpoints are used unchanged. Relative explicit or preset endpoints are resolved against baseUrl; a flow that needs a relative endpoint fails configuration validation when baseUrl is absent. Explicit empty userInfoUrl and logoutUrl values disable those optional endpoints. Validation is flow-specific. Login requires its authorization inputs, callback and refresh require their token and enabled validation inputs, and logout validates only configured logout behavior. This allows configurations that provide complete absolute endpoints to omit a provider baseUrl.",{"id":768,"title":769,"titles":770,"content":771,"level":141},"\u002Fconfiguration#reading-effective-provider-configuration-on-the-server","Reading effective provider configuration on the server",[109,749],"Use useOidcProviderConfig in server routes and utilities to read resolved provider defaults,\nruntime environment overrides, endpoint URLs, and provider placeholders: export default defineEventHandler((event) => {\n  const github = useOidcProviderConfig(event, 'github')\n  return { authorizationUrl: github.authorizationUrl }\n}) This helper is server-only and returns EffectiveProviderConfig for the selected provider. Values\nstored directly in useRuntimeConfig(event).oidc.providers use ProviderRuntimeConfig, the raw\noverride shape. Do not treat that raw storage as resolved configuration or expose it to client code. NODE_ENV is classified as production when its value starts with prod, case-insensitively. This classification controls the default secure-cookie flag and disables dev mode. Values such as production, prod, and PROD-preview are production; an unset value is non-production.",{"id":773,"title":774,"titles":775,"content":776,"level":141},"\u002Fconfiguration#global-session-configuration-session","Global session configuration (session)",[109,749],"The following options are available for the global session configuration. Note that singleSignOut and singleSignOutIdField are provider specific options and can only be configured in providers.\u003Cprovider>.sessionConfiguration. OptionTypeDefaultDescriptioncookieNamestring'nuxt-oidc-auth'Cookie name used for the user sessionautomaticRefreshbooleantrueAutomatically refresh access token and session if refresh token is available (indicated by canRefresh property on user object)expirationCheckbooleantrueCheck if session is expired based on access token expexpirationThresholdnumber0Amount of seconds before access token expiration to trigger automatic refreshmissingPersistentSession'clear' | 'warn' | 'silent''clear'Behavior when a refreshable cookie session exists but the persistent session entry is missing. clear removes stale session and requires re-login, warn keeps session and logs a warning, silent keeps session without warningmaxAgenumber60 * 60 * 24 (1 day)Maximum user session duration in secondsmaxAuthSessionAgenumber300 (5 minutes)Maximum OAuth flow\u002Fauth session duration in secondscookie{ sameSite?: true | false | 'lax' | 'strict' | 'none'; secure?: boolean }{ sameSite: 'lax', secure: NODE_ENV starts with 'prod' }Additional cookie setting overrides for sameSite and secure",{"id":778,"title":779,"titles":780,"content":781,"level":141},"\u002Fconfiguration#provider-session-configuration","Provider session configuration",[109,749],"The following options are available on every provider as overrides for the global session configuration. OptionTypeDefaultDescriptioncookieNamestring'nuxt-oidc-auth'Cookie name used for the user session for this providerautomaticRefreshbooleantrueAutomatically refresh access token and session if refresh token is available (indicated by canRefresh property on user object)expirationCheckbooleantrueCheck if session is expired based on access token expexpirationThresholdnumber0Amount of seconds before access token expiration to trigger automatic refreshmissingPersistentSession'clear' | 'warn' | 'silent''clear'Overrides global behavior for missing persistent session entriesmaxAuthSessionAgenumberInherits global valueMaximum OAuth flow\u002Fauth session duration in seconds for this providersingleSignOutbooleanfalseEnable cross-tab\u002Fbrowser single sign-out supportsingleSignOutIdField'sub' | 'aud''sub'Token field used to derive the single sign-out session id",{"id":783,"title":784,"titles":785,"content":786,"level":141},"\u002Fconfiguration#middleware-configuration-middleware","Middleware configuration (middleware)",[109,749],"OptionTypeDefaultDescriptionglobalMiddlewareEnabledbooleantrueEnables\u002Fdisables the global middlewareredirectbooleantrueEnables\u002Fdisables automatic redirect to login when user is unauthenticatedcustomLoginPagebooleanfalseEnables\u002Fdisables automatic registration of \u002Fauth\u002Flogin route rulecustomLogoutPagebooleanfalseEnables\u002Fdisables automatic registration of \u002Fauth\u002Flogout route rule",{"id":788,"title":789,"titles":790,"content":791,"level":141},"\u002Fconfiguration#dev-mode-configuration-devmode","Dev Mode configuration (devMode)",[109,749],"For more details, please check the dev mode docs page OptionTypeDefaultDescriptionenabledbooleanfalseEnables\u002Fdisables the dev mode. Dev mode can only be enabled when the app runs in a non production environment.userNamestring'Nuxt OIDC Auth Dev'Sets the userName field on the user objectuserInfoRecord\u003Cstring, unknown>undefinedSets the userInfo field on the user objecttokenAlgorithm'symmetric' | 'asymmetric''asymmetric'Sets the key algorithm for signing generated JWT tokensidTokenstringundefinedSets the idToken field on the user objectaccessTokenstringundefinedSets the accessToken field on the user objectclaimsRecord\u003Cstring, string>undefinedSets the claims field on the user object and generated JWT token if generateAccessToken is set to truegenerateAccessTokenbooleanfalseIf set, generates a JWT token for the accessToken field based on the given user informationissuerstring'nuxt:oidc:auth:issuer'Only used with generateAccessToken. Sets the issuer field on the generated JWT tokenaudiencestring'nuxt:oidc:auth:audience'Only used with generateAccessToken. Sets the audience field on the generated JWT tokensubjectstring'nuxt:oidc:auth:subject'Only used with generateAccessToken. Sets the subject field on the generated JWT token",{"id":793,"title":794,"titles":795,"content":796,"level":135},"\u002Fconfiguration#example-configuration","Example configuration",[109],"oidc: {\n    defaultProvider: 'github',\n    providers: {\n      github: {\n        redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fgithub\u002Fcallback',\n        clientId: '',\n        clientSecret: '',\n        filterUserInfo: ['login', 'id', 'avatar_url', 'name', 'email'],\n      },\n      keycloak: {\n        audience: 'account',\n        baseUrl: '',\n        clientId: '',\n        clientSecret: '',\n        redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fkeycloak\u002Fcallback',\n        userNameClaim: 'preferred_username',\n      },\n      cognito: {\n        clientId: '',\n        redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fcognito\u002Fcallback',\n        clientSecret: '',\n        scope: ['openid', 'email', 'profile'],\n        logoutRedirectUri: 'https:\u002F\u002Fgoogle.com',\n        baseUrl: '',\n        exposeIdToken: true,\n      },\n      zitadel: {\n        clientId: '',\n        redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Fzitadel\u002Fcallback',\n        baseUrl: '',\n        audience: '', \u002F\u002F Specify for id token validation, normally same as clientId\n        logoutRedirectUri: 'https:\u002F\u002Fgoogle.com', \u002F\u002F Needs to be registered in Zitadel portal\n        authenticationScheme: 'none',\n      },\n    },\n    session: {\n      expirationCheck: true,\n      automaticRefresh: true,\n      expirationThreshold: 3600,\n      missingPersistentSession: 'clear',\n    },\n    middleware: {\n      globalMiddlewareEnabled: true,\n      customLoginPage: true,\n      customLogoutPage: false,\n    },\n    devMode: {\n      enabled: false,\n      generateAccessToken: true,\n      userName: 'Test User',\n      userInfo: { providerName: 'test' },\n      claims: { customclaim01: 'foo', customclaim02: 'bar' },\n      issuer: 'dev-issuer',\n      audience: 'dev-app',\n      subject: 'dev-user',\n    },\n  },",{"id":114,"title":113,"titles":798,"content":799,"level":129},[],"How to contribute to nuxt-oidc-auth",{"id":801,"title":113,"titles":802,"content":803,"level":135},"\u002Fcontributing#contributing",[113],"# Install dependencies\npnpm install\n\n# Generate type stubs\npnpm run dev:prepare\n\n# Develop with the playground\npnpm run dev\n\n# Build the playground\npnpm run dev:build\n\n# Run ESLint\npnpm run lint\n\n# Run in-process functional handler tests\npnpm test:functional",{"id":805,"title":806,"titles":807,"content":808,"level":135},"\u002Fcontributing#end-to-end-tests","End-to-end tests",[113],"Provider credentials are declared in secretspec.toml. Configure SecretSpec's\ne2e provider with access to the nuxt-oidc-auth 1Password vault, then run: pnpm test:e2e:providers:secrets Generic OIDC does not require provider credentials. Unconfigured cloud providers\nare skipped. CI reads the same profile and vault with its own read-only\nOP_SERVICE_ACCOUNT_TOKEN. Keycloak coverage stays manual and separate from quick CI and provider-matrix\nruns. Start deterministic fixture, then run dedicated suite: docker compose -f test\u002Ffixtures\u002Fkeycloak\u002Fcompose.yaml up -d --wait\npnpm test:e2e:keycloak\ndocker compose -f test\u002Ffixtures\u002Fkeycloak\u002Fcompose.yaml down Fixture imports realm nuxt-oidc-test with local user testuser \u002F p@ssword.",{"id":810,"title":811,"titles":812,"content":813,"level":135},"\u002Fcontributing#release-gate","Release gate",[113],"Prepare version and changelog without creating a commit, tag, or publication: git switch -c release\u002F\u003Cversion>\npnpm release:prepare -- \u003Cversion> [--from \u003Cprevious-release-commit>] For v1.0.0-beta.12, use 63ab0c7 as previous release commit because existing\nv1.0.0-beta.11 tag does not point to published beta.11 package commit. Review\ngenerated changes, commit them with signing enabled, and merge them through pull request. From clean, up-to-date main, record exact release commit and dispatch Provider E2E: release_commit=$(git rev-parse HEAD)\ngh workflow run e2e-providers.yml --ref main Confirm workflow run succeeded and its headSha equals $release_commit. Configured\nonline-provider and Dex rows must pass; Apple and PayPal remain excluded. Create and push\nsigned tag only from exact verified commit: pnpm release:tag -- \"$release_commit\" Tagging refuses dirty trees, commits other than origin\u002Fmain, mismatched provider-test commit,\nmissing changelog entry, existing npm version, or existing\u002Fmismatched tag. Existing\nv1.0.0-beta.11 tag must remain untouched. Configure npm trusted publishing for GitHub\norganization\u002Fuser itpropro, repository nuxt-oidc-auth, workflow filename release.yml, no\nenvironment, and allow npm publish.\nAfter signed-tag Provider E2E succeeds, dispatch Publish npm release from main with tag\nname. Workflow requires signed tag, exact origin\u002Fmain commit, matching changelog\u002Fpackage\nversion, and unpublished npm version. GitHub OIDC publishes without repository npm credentials\nand npm automatically records provenance.",{"id":815,"title":58,"body":816,"description":416,"extension":1131,"external":12,"features":11,"hero":11,"meta":1132,"navigation":123,"path":59,"seo":1134,"stem":60,"target":11,"to":11,"__hash__":1135},"docs\u002F2.provider\u002F7.logto.md",{"type":817,"value":818,"toc":1122},"minimark",[819,823,842,845,847,850,857,861,964,967,970,993,996,999,1087,1118],[820,821,260],"h2",{"id":822},"featureoidc-support",[824,825,826,827,830,831,833,834,836,837,839,840],"p",{},"✅  PKCE",[828,829],"br",{},"\n✅  State",[828,832],{},"\n✅  Nonce",[828,835],{},"\n❌  Access Token validation",[828,838],{},"\n✅  ID Token validation",[828,841],{},[820,843,10],{"id":844},"introduction",[824,846,424],{},[820,848,274],{"id":849},"example-configuration",[851,852,855],"callout",{"color":853,"icon":854},"amber","i-carbon-warning-alt",[824,856,428],{},[858,859,431],"h3",{"id":860},"minimal",[862,863,868],"pre",{"className":864,"code":865,"filename":866,"language":867,"meta":134,"style":134},"language-typescript shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","logto: {\n  baseUrl: '',\n  clientId: '',\n  clientSecret: '',\n  redirectUri: 'http:\u002F\u002Flocalhost:3000\u002Fauth\u002Flogto\u002Fcallback',\n  logoutRedirectUri: 'http:\u002F\u002Flocalhost:3000',\n}\n","nuxt.config.ts","typescript",[869,870,871,886,899,910,921,941,958],"code",{"__ignoreMap":134},[872,873,875,879,883],"span",{"class":874,"line":129},"line",[872,876,878],{"class":877},"sBMFI","logto",[872,880,882],{"class":881},"sMK4o",":",[872,884,885],{"class":881}," {\n",[872,887,888,891,893,896],{"class":874,"line":135},[872,889,890],{"class":877},"  baseUrl",[872,892,882],{"class":881},[872,894,895],{"class":881}," ''",[872,897,898],{"class":881},",\n",[872,900,901,904,906,908],{"class":874,"line":141},[872,902,903],{"class":877},"  clientId",[872,905,882],{"class":881},[872,907,895],{"class":881},[872,909,898],{"class":881},[872,911,912,915,917,919],{"class":874,"line":675},[872,913,914],{"class":877},"  clientSecret",[872,916,882],{"class":881},[872,918,895],{"class":881},[872,920,898],{"class":881},[872,922,924,927,929,932,936,939],{"class":874,"line":923},5,[872,925,926],{"class":877},"  redirectUri",[872,928,882],{"class":881},[872,930,931],{"class":881}," '",[872,933,935],{"class":934},"sfazB","http:\u002F\u002Flocalhost:3000\u002Fauth\u002Flogto\u002Fcallback",[872,937,938],{"class":881},"'",[872,940,898],{"class":881},[872,942,944,947,949,951,954,956],{"class":874,"line":943},6,[872,945,946],{"class":877},"  logoutRedirectUri",[872,948,882],{"class":881},[872,950,931],{"class":881},[872,952,953],{"class":934},"http:\u002F\u002Flocalhost:3000",[872,955,938],{"class":881},[872,957,898],{"class":881},[872,959,961],{"class":874,"line":960},7,[872,962,963],{"class":881},"}\n",[858,965,279],{"id":966},"environment-variables",[824,968,969],{},"Dotenv files are only for (local) development. Use a proper configuration management or injection system in production.",[862,971,976],{"className":972,"code":973,"filename":974,"language":975,"meta":134,"style":134},"language-ini shiki shiki-themes material-theme-lighter material-theme material-theme-palenight","NUXT_OIDC_PROVIDERS_LOGTO_CLIENT_SECRET=CLIENT_SECRET\nNUXT_OIDC_PROVIDERS_LOGTO_CLIENT_ID=CLIENT_ID\nNUXT_OIDC_PROVIDERS_LOGTO_BASE_URL=https:\u002F\u002FYOUR_LOGTO_DOMAIN\n",".env","ini",[869,977,978,983,988],{"__ignoreMap":134},[872,979,980],{"class":874,"line":129},[872,981,982],{},"NUXT_OIDC_PROVIDERS_LOGTO_CLIENT_SECRET=CLIENT_SECRET\n",[872,984,985],{"class":874,"line":135},[872,986,987],{},"NUXT_OIDC_PROVIDERS_LOGTO_CLIENT_ID=CLIENT_ID\n",[872,989,990],{"class":874,"line":141},[872,991,992],{},"NUXT_OIDC_PROVIDERS_LOGTO_BASE_URL=https:\u002F\u002FYOUR_LOGTO_DOMAIN\n",[820,994,269],{"id":995},"provider-specific-parameters",[824,997,998],{},"The Logto provider supports several specific parameters to customize the authentication experience:",[1000,1001,1002,1021],"table",{},[1003,1004,1005],"thead",{},[1006,1007,1008,1012,1015,1018],"tr",{},[1009,1010,1011],"th",{},"Option",[1009,1013,1014],{},"Type",[1009,1016,1017],{},"Default",[1009,1019,1020],{},"Description",[1022,1023,1024,1041,1055,1069],"tbody",{},[1006,1025,1026,1030,1035,1038],{},[1027,1028,1029],"td",{},"firstScreen",[1027,1031,1032],{},[869,1033,1034],{},"string",[1027,1036,1037],{},"-",[1027,1039,1040],{},"Specifies the initial screen shown to users during authentication. This can be used to direct users to specific authentication flows.",[1006,1042,1043,1046,1050,1052],{},[1027,1044,1045],{},"identifier",[1027,1047,1048],{},[869,1049,1034],{},[1027,1051,1037],{},[1027,1053,1054],{},"Defines which identifier types are accepted in the sign-in or sign-up form. This allows you to restrict authentication methods.",[1006,1056,1057,1060,1064,1066],{},[1027,1058,1059],{},"loginHint",[1027,1061,1062],{},[869,1063,1034],{},[1027,1065,1037],{},[1027,1067,1068],{},"Pre-populates the identifier field with a user's email or username. Useful for improving user experience when the identity is known.",[1006,1070,1071,1074,1079,1084],{},[1027,1072,1073],{},"prompt",[1027,1075,1076],{},[869,1077,1078],{},"'login' | 'none' | 'consent' | 'select_account'",[1027,1080,1081],{},[869,1082,1083],{},"consent",[1027,1085,1086],{},"Controls the authentication behavior: 'login' forces authentication, 'none' prevents interaction, 'consent' requires explicit consent, and 'select_account' allows account selection.",[824,1088,1089,1090,1093,1094,1097,1098,1101,1102,1104,1105,1093,1108,1093,1111,1097,1114,1117],{},"For Logto you have to provide at least the ",[869,1091,1092],{},"baseUrl",", ",[869,1095,1096],{},"clientId"," and ",[869,1099,1100],{},"clientSecret"," properties. The ",[869,1103,1092],{}," is used to dynamically create the ",[869,1106,1107],{},"authorizationUrl",[869,1109,1110],{},"tokenUrl",[869,1112,1113],{},"logoutUrl",[869,1115,1116],{},"userInfoUrl",".",[1119,1120,1121],"style",{},"html pre.shiki code .sBMFI, html code.shiki .sBMFI{--shiki-light:#E2931D;--shiki-default:#FFCB6B;--shiki-dark:#FFCB6B}html pre.shiki code .sMK4o, html code.shiki .sMK4o{--shiki-light:#39ADB5;--shiki-default:#89DDFF;--shiki-dark:#89DDFF}html pre.shiki code .sfazB, html code.shiki .sfazB{--shiki-light:#91B859;--shiki-default:#C3E88D;--shiki-dark:#C3E88D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":134,"searchDepth":135,"depth":135,"links":1123},[1124,1125,1126,1130],{"id":822,"depth":135,"text":260},{"id":844,"depth":135,"text":10},{"id":849,"depth":135,"text":274,"children":1127},[1128,1129],{"id":860,"depth":141,"text":431},{"id":966,"depth":141,"text":279},{"id":995,"depth":135,"text":269},"md",{"icon":1133},"i-carbon-ibm-engineering-requirements-doors-next",{"title":58,"description":416},"K53wqPLNDJ1QsErq_s65jfXbh9WIW2k9Xyn5zPNeSOk",[1137,1138],{"title":54,"path":55,"stem":56,"description":377,"children":-1},{"title":62,"path":63,"stem":64,"description":444,"children":-1},{"release":1140},{"id":1141,"tag":1142,"author":1143,"name":1142,"draft":12,"prerelease":12,"createdAt":1144,"publishedAt":1145,"markdown":1146,"html":1147,"assets":1148},307136660,"v1.0.0-beta.11","itpropro","2026-04-09T15:18:25Z","2026-04-09T15:23:18Z","[compare changes](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcompare\u002Fv1.0.0-beta.10...v1.0.0-beta.11)\r\n\r\n### 🩹 Fixes\r\n\r\n- **config:** Reject empty, whitespace-only, and null values in validateConfig ([ada823a](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002Fada823a))\r\n- **session:** Slide cookie expiry forward on token refresh ([1e7f855](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F1e7f855))\r\n- Tighten runtime typing and align callback redirect tests ([7fd2643](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F7fd2643))\r\n- **types:** Align oidc module typing with Nuxt type contexts ([f0a22b2](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002Ff0a22b2))\r\n- **runtime:** Tighten oidc flow and session handling ([9b238f5](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F9b238f5))\r\n- **devmode:** Preserve callback redirect after dev login ([e3c085b](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002Fe3c085b))\r\n\r\n### 📖 Documentation\r\n\r\n- Add quickstart links and improve provider documentation ([35245c9](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F35245c9))\r\n\r\n### 🏡 Chore\r\n\r\n- **lint:** Fix all eslint errors ([7ac9233](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F7ac9233))\r\n- **lint:** Migrate to oxlint + oxfmt pipeline ([2ff6a3d](https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F2ff6a3d))\r\n\r\n### ❤️ Contributors\r\n\r\n- Jan-Henrik Damaschke (@itpropro)","\u003Cp>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcompare\u002Fv1.0.0-beta.10...v1.0.0-beta.11\">compare changes\u003C\u002Fa>\u003C\u002Fp>\n\u003Cdiv class=\"markdown-heading\">\u003Ch3 class=\"heading-element\">🩹 Fixes\u003C\u002Fh3>\u003Ca id=\"user-content--fixes\" class=\"anchor\" aria-label=\"Permalink: 🩹 Fixes\" href=\"#-fixes\">\u003Cspan aria-hidden=\"true\" class=\"octicon octicon-link\">\u003C\u002Fspan>\u003C\u002Fa>\u003C\u002Fdiv>\n\u003Cul>\n\u003Cli>\n\u003Cstrong>config:\u003C\u002Fstrong> Reject empty, whitespace-only, and null values in validateConfig (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002Fada823a\">ada823a\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\n\u003Cstrong>session:\u003C\u002Fstrong> Slide cookie expiry forward on token refresh (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F1e7f855\">1e7f855\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>Tighten runtime typing and align callback redirect tests (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F7fd2643\">7fd2643\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\n\u003Cstrong>types:\u003C\u002Fstrong> Align oidc module typing with Nuxt type contexts (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002Ff0a22b2\">f0a22b2\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\n\u003Cstrong>runtime:\u003C\u002Fstrong> Tighten oidc flow and session handling (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F9b238f5\">9b238f5\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\n\u003Cstrong>devmode:\u003C\u002Fstrong> Preserve callback redirect after dev login (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002Fe3c085b\">e3c085b\u003C\u002Fa>)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cdiv class=\"markdown-heading\">\u003Ch3 class=\"heading-element\">📖 Documentation\u003C\u002Fh3>\u003Ca id=\"user-content--documentation\" class=\"anchor\" aria-label=\"Permalink: 📖 Documentation\" href=\"#-documentation\">\u003Cspan aria-hidden=\"true\" class=\"octicon octicon-link\">\u003C\u002Fspan>\u003C\u002Fa>\u003C\u002Fdiv>\n\u003Cul>\n\u003Cli>Add quickstart links and improve provider documentation (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F35245c9\">35245c9\u003C\u002Fa>)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cdiv class=\"markdown-heading\">\u003Ch3 class=\"heading-element\">🏡 Chore\u003C\u002Fh3>\u003Ca id=\"user-content--chore\" class=\"anchor\" aria-label=\"Permalink: 🏡 Chore\" href=\"#-chore\">\u003Cspan aria-hidden=\"true\" class=\"octicon octicon-link\">\u003C\u002Fspan>\u003C\u002Fa>\u003C\u002Fdiv>\n\u003Cul>\n\u003Cli>\n\u003Cstrong>lint:\u003C\u002Fstrong> Fix all eslint errors (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F7ac9233\">7ac9233\u003C\u002Fa>)\u003C\u002Fli>\n\u003Cli>\n\u003Cstrong>lint:\u003C\u002Fstrong> Migrate to oxlint + oxfmt pipeline (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fitpropro\u002Fnuxt-oidc-auth\u002Fcommit\u002F2ff6a3d\">2ff6a3d\u003C\u002Fa>)\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cdiv class=\"markdown-heading\">\u003Ch3 class=\"heading-element\">❤️ Contributors\u003C\u002Fh3>\u003Ca id=\"user-content-️-contributors\" class=\"anchor\" aria-label=\"Permalink: ❤️ Contributors\" href=\"#️-contributors\">\u003Cspan aria-hidden=\"true\" class=\"octicon octicon-link\">\u003C\u002Fspan>\u003C\u002Fa>\u003C\u002Fdiv>\n\u003Cul>\n\u003Cli>Jan-Henrik Damaschke (@itpropro)\u003C\u002Fli>\n\u003C\u002Ful>\n",[],1787009688254]