panva/node-oidc-provider

This is a Node.js library for building your own login and authorization server. When an app needs to let users sign in and then decide what those users are allowed to access, it needs something called an OAuth 2.0 Authorization Server. This library provides that, built for Node.js and certified by the OpenID Foundation. The library implements OpenID Connect, which is a standard layer on top of OAuth 2.0 that adds user identity: not just "is this token valid," but "who is this person." It covers a very wide range of related specifications, including device login flows (for TVs or CLI tools where you can't type a URL), pushed authorization requests, proof-of-possession tokens, mutual TLS authentication, and more. These are the formal standards used by enterprise and financial-grade applications. In practice, you create a Provider instance with a base URL and a list of registered client applications. The provider then handles all the login endpoints, token issuance, and discovery documents that other apps need to authenticate against it. It can be added to an existing Express, Koa, Fastify, Hapi, or Connect application rather than running as a standalone service. The library is OpenID Certified, meaning it has been tested and confirmed to conform to specific OpenID Connect profiles. It also emits events during key actions, such as when a token is issued or an authorization request is denied, so you can hook into those moments to add logging or metrics. This is a project for developers who need to run their own identity provider rather than using a hosted service like Auth0 or Okta. Auth0 by Okta sponsors the project. The v9.x branch is actively maintained with new features, v8.x receives security fixes only.