@jackdbd/fastify-revocation-endpoint

@jackdbd/fastify-revocation-endpoint

Fastify plugin that adds an IndieAuth Token Revocation endpoint to a Fastify server.

• Installation
• Revocation Endpoint Options
  • jwksUrl: JWKS public URL
• Dependencies
• References
• License

Installation

npm install @jackdbd/fastify-revocation-endpoint

Revocation Endpoint Options

Options for the Fastify revocation-endpoint plugin

Properties

Name	Type	Description	Required
ajv		Instance of Ajv	no
includeErrorDescription	boolean	Whether to include an error_description property in all error responses. This is meant to assist the client developer in understanding the error. This is NOT meant to be shown to the end user. Default: false	no
isAccessTokenRevoked	Function	Predicate function that returns true if a jti (JSON Web Token ID) is revoked.	yes
issuer	string	The authorization server's issuer identifier. It's a URL that uses the "https" scheme and has no query or fragment components. It MUST also be a prefix of the indieauth-metadata URL. Format: "uri"	yes
jwksUrl (JWKS public URL)	object	URL where the public JSON Web Key Set is hosted.	yes
logPrefix	string	Default: "revocation-endpoint "	no
maxAccessTokenAge	string	Minimal Length: 1	no
me			yes
reportAllAjvErrors (report all AJV errors)	boolean	Whether to report all AJV validation errors. Default: false	no
retrieveAccessToken	Function	Function that retrieves an access token from a storage backend.	yes
retrieveRefreshToken	Function	Function that retrieves a refresh token from a storage backend.	yes
revokeAccessToken	Function	Handler invoked when the token revocation endpoint has met all requirements to revoke a token. You should use it to mark the access token as revoked in your storage backend.	yes
revokeRefreshToken	Function	Handler invoked when the token revocation endpoint has met all requirements to revoke a token. You should use it to mark the refresh token as revoked in your storage backend.	yes

Example

{
    "includeErrorDescription": false,
    "jwksUrl": {},
    "logPrefix": "revocation-endpoint ",
    "reportAllAjvErrors": false
}

jwksUrl: JWKS public URL

URL where the public JSON Web Key Set is hosted.

Properties

Name	Type	Description	Required
hash	string		yes
host	string		yes
href	string		yes
hostname	string		yes
origin	string		yes
password	string		yes
pathname	string		yes
port	string		yes
protocol	string		yes
search	string		yes
searchParams			yes
username	string		yes
toJSON			yes

Additional Properties: allowed

Dependencies

Package	Version
@fastify/formbody	^8.0.2
@fastify/response-validation	^3.0.3
@jackdbd/indieauth	^0.0.0-canary.1
@jackdbd/oauth2	^0.0.0-canary.1
@jackdbd/oauth2-error-responses	^0.0.0-canary.1
@jackdbd/oauth2-tokens	^0.0.0-canary.1
@jackdbd/schema-validators	^0.0.0-canary.1
@sinclair/typebox	^0.34.14
ajv	^8.17.1
ajv-formats	^3.0.1
fastify-plugin	^5.0.1

⚠️ Peer Dependencies

This package defines 1 peer dependency.

Peer	Version range
fastify	>=5.0.0

References

• OAuth 2.0 Token Revocation (RFC 7009)
• Token revocation on OAuth.net

License

© 2024 - 2025 Giacomo Debidda // MIT License