@kothatech/auth-js

A framework-agnostic client SDK for managing the complex PKCE authorization code flow natively in the browser.

npm install @kothatech/auth-js

Usage

Initiate login from your SPA:

import KothaAuth from '@kothatech/auth-js';

const auth = new KothaAuth({
  clientId: 'YOUR_CLIENT_ID',
  redirectUri: window.location.origin + '/callback',
  issuer: 'https://auth.kotha.im' // Or http://localhost:4000
});

// Redirects user to Kotha Auth login page
document.getElementById('login').onclick = () => auth.loginWithRedirect();

Handle the callback route (e.g. `/callback`):

// Automatically exchanges the code for a JWT token
try {
  let tokens = await auth.handleRedirectCallback();
  console.log('Logged in successfully');

  // Refresh tokens rotate: always replace the old token.
  tokens = await auth.refreshTokens(tokens.refresh_token);

  // Logout/revoke the complete refresh session.
  await auth.revokeToken(tokens.refresh_token, 'refresh_token');
} catch (err) {
  console.error('Login failed', err);
}

Token Storage

Do not store refresh tokens in localStorage. Prefer memory or a backend-for-frontend, and always replace the old refresh token with the value returned by a successful refresh.