Documentation

@udibo/oauth2 helps you add authentication and authorization to an application. Choose who hosts sign-in first; that determines which parts of the package you need.

Use Udibo's identity service

Udibo hosts the sign-in flow and issues tokens. Your app handles its callback, keeps its own session, and validates access to its API. You do not need to implement password storage, MFA enrollment, or an authorization server.

You need a Udibo account; see udibo.com for how to get one. If you already have an account, start with the integration guide.

Then read API protection and environment configuration.

Host authorization for your own app

Your app owns its users, login pages, and persistent storage. The package provides OAuth2 protocol handling and optional identity flows.

Add only the features your application needs:

Feature	Guide
Social or enterprise OIDC login	External sign-in
TOTP and recovery codes	MFA
Passkeys (WebAuthn)	Passkeys
Email codes and magic links	Passwordless sign-in
Existing password hashes	Password migration
Bot challenge for own login	CAPTCHA route example

These guides explain application integrations. Hosted-service administration, commercial platform architecture, and internal Udibo operations are outside this package's documentation.

Testing and reference

React integration: session state, rendering guards, and app-owned forms.
Integration testing: route fixtures, persistent store contracts, and browser checks.
Local identity provider: exercise your client against a local OAuth2/OIDC server without a hosted account.
Deployment checklist: review the boundaries your chosen integration uses.
Extension reference: callback and storage contracts.
Partial-failure recovery: what a failing store leaves behind in each identity flow, and how to finish it.
Known limitations: supported behavior and constraints.
API reference: exported types and methods.
Versioning and runtime support.
Issue triage and security disclosure.
Agent index and complete documentation.

Code fences show one of three things: a runnable command, a self-contained example, or integration wiring that explicitly declares app-owned dependencies. A declare const represents something your application must supply; it is not an implementation to paste into production.