@lastshotlabs/slingshot-oauth
npm install @lastshotlabs/slingshot-oauth
Functions
Section titled “Functions”buildConnectionClient
Section titled “buildConnectionClient”function buildConnectionClient(providerKey: string, config: ConnectionProviderConfig,): ConnectionOAuthClientSource: packages/slingshot-oauth/src/connections.ts
createConnectionsRouter
Section titled “createConnectionsRouter”Normalized OAuth client for a connection provider. Arctic’s per-provider
classes differ in PKCE arity; this interface papers over that so the routes
and the refresh helper stay provider-agnostic. createClient in the
provider config is the escape hatch for providers arctic lacks.
function createConnectionsRouter(app: object, options: ConnectionsOptions, runtime: AuthRuntimeContext, postRedirect: string,): voidSource: packages/slingshot-oauth/src/connections.ts
createOAuthPlugin
Section titled “createOAuthPlugin”Options for createOAuthPlugin.
All fields are optional - the plugin works out of the box with defaults.
function createOAuthPlugin(options?: OAuthPluginOptions): SlingshotPluginSource: packages/slingshot-oauth/src/plugin.ts
createOAuthRouter
Section titled “createOAuthRouter”Builds a HookContext from a Hono context for use with auth lifecycle hooks.
Extracts the client IP, User-Agent, and requestId from the current request.
When the IP is 'unknown' (e.g. behind a misconfigured proxy), it is omitted.
function createOAuthRouter(providers: string[], postLoginRedirect: string, runtime: AuthRuntimeContext, rateLimit?: import('@lastshotlabs/slingshot-auth').AuthRateLimitConfig,): voidConfig Fields
Section titled “Config Fields”| Field | Description |
|---|---|
code | TOTP code, email OTP code, or recovery code. |
method | Verification method to use. |
password | Account password. |
reauthToken | Reauth challenge token (required for emailOtp and webauthn methods). |
webauthnResponse | WebAuthn assertion response (required for webauthn method). |
Source: packages/slingshot-oauth/src/routes/oauth.ts
getConnectionAccessToken
Section titled “getConnectionAccessToken”Normalized OAuth client for a connection provider. Arctic’s per-provider
classes differ in PKCE arity; this interface papers over that so the routes
and the refresh helper stay provider-agnostic. createClient in the
provider config is the escape hatch for providers arctic lacks.
async function getConnectionAccessToken(app: object, userId: string, provider: string,): Promise<ConnectionAccessToken | null>Source: packages/slingshot-oauth/src/connections.ts
getProviderConnection
Section titled “getProviderConnection”Normalized OAuth client for a connection provider. Arctic’s per-provider
classes differ in PKCE arity; this interface papers over that so the routes
and the refresh helper stay provider-agnostic. createClient in the
provider config is the escape hatch for providers arctic lacks.
async function getProviderConnection(app: object, userId: string, provider: string,): Promise<ProviderConnectionSummary | null>Source: packages/slingshot-oauth/src/connections.ts
oauthPluginConfigSchema
Section titled “oauthPluginConfigSchema”Source: packages/slingshot-oauth/src/plugin.ts
verifyAppleIdentityToken
Section titled “verifyAppleIdentityToken”Verify a Sign in with Apple identity token before trusting identity claims.
Arctic’s decodeIdToken() only parses the JWT. Apple requires signature,
algorithm, issuer, audience, expiry, issued-at, subject, and nonce validation.
async function verifyAppleIdentityToken(idToken: string, clientId: string, expectedNonce: string, key: AppleVerificationKey = appleJwks,): Promise<AppleIdentityClaims>Source: packages/slingshot-oauth/src/lib/appleIdentityToken.ts
Interfaces
Section titled “Interfaces”AppleIdentityClaims
Section titled “AppleIdentityClaims”Source: packages/slingshot-oauth/src/lib/appleIdentityToken.ts
ConnectionAccessToken
Section titled “ConnectionAccessToken”Normalized OAuth client for a connection provider. Arctic’s per-provider
classes differ in PKCE arity; this interface papers over that so the routes
and the refresh helper stay provider-agnostic. createClient in the
provider config is the escape hatch for providers arctic lacks.
Source: packages/slingshot-oauth/src/connections.ts
ConnectionOAuthClient
Section titled “ConnectionOAuthClient”Normalized OAuth client for a connection provider. Arctic’s per-provider
classes differ in PKCE arity; this interface papers over that so the routes
and the refresh helper stay provider-agnostic. createClient in the
provider config is the escape hatch for providers arctic lacks.
Source: packages/slingshot-oauth/src/connections.ts
ConnectionProviderConfig
Section titled “ConnectionProviderConfig”Source: packages/slingshot-oauth/src/connections.ts
ConnectionsOptions
Section titled “ConnectionsOptions”Source: packages/slingshot-oauth/src/connections.ts
ProviderConnectionSummary
Section titled “ProviderConnectionSummary”Normalized OAuth client for a connection provider. Arctic’s per-provider
classes differ in PKCE arity; this interface papers over that so the routes
and the refresh helper stay provider-agnostic. createClient in the
provider config is the escape hatch for providers arctic lacks.
Source: packages/slingshot-oauth/src/connections.ts
OAuthPluginConfig
Section titled “OAuthPluginConfig”Options for createOAuthPlugin.
All fields are optional - the plugin works out of the box with defaults.
Source: packages/slingshot-oauth/src/plugin.ts
OAuthPluginOptions
Section titled “OAuthPluginOptions”Options for createOAuthPlugin.
All fields are optional - the plugin works out of the box with defaults.
Source: packages/slingshot-oauth/src/plugin.ts