sveltekit-oidc

OIDC authentication helpers for SvelteKit with:

• server-side login, callback, logout, and session refresh flows
• token endpoint auth support for none, client_secret_basic, client_secret_post, client_secret_jwt, and private_key_jwt
• back-channel logout support through a revocation store
• signed cookie-backed sessions and PKCE/state protection
• a handle hook for attaching auth state to event.locals
• a small OIDCContext provider for client-side auth state and session lifecycle handling

Install

npm install sveltekit-oidc
Copy

Server Setup

// src/lib/server/auth.ts
import {
	createInMemoryBackChannelLogoutStore,
	createOIDC
} from 'sveltekit-oidc/server';

export const oidc = createOIDC({
	issuer: 'https://your-idp.example.com',
	clientId: process.env.OIDC_CLIENT_ID!,
	clientSecret: process.env.OIDC_CLIENT_SECRET!,
	cookieSecret: process.env.OIDC_COOKIE_SECRET!,
	clientAuthMethod: 'client_secret_basic',
	loginPath: '/auth/login',
	redirectPath: '/auth/callback',
	scope: ['openid', 'profile', 'email', 'offline_access'],
	clockSkewSeconds: 30,
	fetchUserInfo: true,
	backChannelLogoutStore: createInMemoryBackChannelLogoutStore(),
	transformSession(session) {
		return {
			...session,
			groups: session.groups,
			user: session.user
				? {
						...session.user,
						groups: session.groups
					}
				: session.user
		};
	},
	cookieOptions: {
		secure: process.env.NODE_ENV === 'production'
	}
});
Copy

// src/hooks.server.ts
import { oidc } from '$lib/server/auth';

export const handle = oidc.handle;
Copy

// src/routes/auth/login/+server.ts
import { oidc } from '$lib/server/auth';

export const GET = oidc.loginHandler();
Copy

// src/routes/auth/callback/+server.ts
import { oidc } from '$lib/server/auth';

export const GET = oidc.callbackHandler({
	redirectTo: '/'
});
Copy

// src/routes/auth/logout/+server.ts
import { oidc } from '$lib/server/auth';

export const GET = oidc.logoutHandler();
export const POST = oidc.logoutHandler();
Copy

// src/routes/auth/backchannel-logout/+server.ts
import { oidc } from '$lib/server/auth';

export const POST = oidc.backChannelLogoutHandler();
Copy

Actions

If you prefer form actions instead of dedicated routes:

// src/routes/+page.server.ts
import { oidc } from '$lib/server/auth';

export const actions = oidc.createActions();
Copy

Load Session

// src/routes/+layout.server.ts
import { oidc } from '$lib/server/auth';

export async function load(event) {
	return {
		session: await oidc.getPublicSession(event),
		sessionManagement: await oidc.getSessionManagementConfig()
	};
}
Copy

Client Setup

<script lang="ts">
	import { OIDCContext } from 'sveltekit-oidc';
	let { data } = $props();
</script>

<OIDCContext
	session={data.session}
	config={data.sessionManagement}
	logoutPath="/auth/logout"
	redirectIfUnauthenticated={false}
>
	<Account />
</OIDCContext>
Copy

<!-- src/lib/Account.svelte -->
<script lang="ts">
	import { useOIDC } from 'sveltekit-oidc';

	const oidc = useOIDC();
</script>

{#if oidc.isAuthenticated}
	<p>Signed in as {oidc.user?.email ?? oidc.user?.name ?? oidc.session?.sub}</p>
	<form method="POST" action="/auth/logout">
		<button type="submit">Sign out</button>
	</form>
{:else}
	<a href="/auth/login?returnTo=%2Faccount">Sign in</a>
{/if}
Copy

OIDCContext handles:

• local expiry redirects
• check_session_iframe polling when the provider advertises it
• periodic invalidateAll() revalidation so revoked server sessions are detected
• a client context for nested auth-aware components through useOIDC() / getOIDCContext()

Example App

This repository now includes a runnable example under src/routes and src/hooks.server.ts.

Set these environment variables to enable it:

• OIDC_ISSUER
• OIDC_CLIENT_ID
• OIDC_COOKIE_SECRET
• optional: OIDC_CLIENT_SECRET
• optional: OIDC_SCOPE
• optional: OIDC_POST_LOGOUT_REDIRECT_URI

Notes

• cookieSecret should be a strong random secret and must stay stable across instances.
• clockSkewSeconds defaults to 30 and tolerates small clock drift between your app and the identity provider.
• createInMemoryBackChannelLogoutStore() is suitable for local development or single-instance deployments. Use Redis, SQL, or another shared store for production.
• The library validates id_token and logout_token values through @sourceregistry/node-jwt and provider JWKS metadata.
• groups are normalized onto the session from groups and roles claims when present.
• Use transformClaims, transformUser, and transformSession to project provider-specific claims into your own session shape.
• check_session_iframe monitoring only runs when the provider advertises that endpoint and the session includes session_state.
• Refresh token handling is automatic when a valid refresh token is present.
• event.locals.oidc is attached by the hook, but you should add your own app.d.ts augmentation in the consuming app for full typing.