Documentation
@udibo/oauth2 helps you add authentication and authorization to an
application. Choose who hosts sign-in first; that determines which parts of the
package you need.
Use Udibo's identity service
Udibo hosts the sign-in flow and issues tokens. Your app handles its callback, keeps its own session, and validates access to its API. You do not need to implement password storage, MFA enrollment, or an authorization server.
Private beta: join the waitlist. If you already have access, start with the integration guide.
Then read API protection and environment configuration.
Host authorization for your own app
Your app owns its users, login pages, and persistent storage. The package provides OAuth2 protocol handling and optional identity flows.
Add only the features your application needs:
| Feature | Guide |
|---|---|
| Social or enterprise OIDC login | External sign-in |
| TOTP and recovery codes | MFA |
| Email codes and magic links | Passwordless sign-in |
| Existing password hashes | Password migration |
These guides explain application integrations. Hosted-service administration, commercial platform architecture, and internal Udibo operations are outside this package's documentation.
Testing and reference
React integration: session state, rendering guards, and app-owned forms.
Integration testing: route fixtures, persistent store contracts, and browser checks.
Local identity provider: exercise your client against a local OAuth2/OIDC server without a hosted account.
Deployment checklist: review the boundaries your chosen integration uses.
Extension reference: callback and storage contracts.
Known limitations: supported behavior and constraints.
API reference: exported types and methods.
Code fences show one of three things: a runnable command, a self-contained
example, or integration wiring that explicitly declares app-owned dependencies.
A declare const represents something your application must supply; it is not
an implementation to paste into production.