infinityauth
Advanced tools
A comprehensive, secure, and developer-friendly authentication package that rivals Auth0, Okta, and Clerk. Built with modern security practices and designed for seamless integration across all platforms.
Note: This diagram shows the complete system architecture including client SDKs, backend services, and data flows.
npm install infinityauth
After install, you'll see a notice: "package author: ashutosh0x".
import { createAuthClient } from 'infinityauth';
const auth = createAuthClient({
baseURL: 'http://localhost:4000',
clientId: 'your-client-id',
});
// Signup
await auth.signup('user@example.com', 'StrongP@ssw0rd!');
// Login
const { accessToken, refreshToken } = await auth.login('user@example.com', 'StrongP@ssw0rd!');
// Current user
const me = await auth.getUser();
// Refresh
const newTokens = await auth.refreshToken();
// Logout
await auth.logout();
const isAdmin = auth.hasRole?.('admin');
// If offline, getUser will return last cached profile
const me = await auth.getUser();
config.baseURL: string (required) – Base URL of InfinityAuth APIconfig.clientId: string (required)config.clientSecret: string (optional)config.storage: 'memory' | 'localStorage' (optional)signup(email, password) → { accessToken, refreshToken, expiresIn }login(email, password) → { accessToken, refreshToken, expiresIn }getUser() → { id, email, role } | nullrefreshToken() → { accessToken, refreshToken, expiresIn }logout() → voidcreateAuthClient({
baseURL: 'http://localhost:4000',
clientId: 'web',
clientSecret?: 'optional',
storage?: 'memory' | 'localStorage' | 'indexeddb',
debug?: true,
fetchAdapter?: (input, init) => fetch(input, init),
});
debug: logs requests and token refresh attemptsfetchAdapter: plug Axios/fetch polyfillsstorage: memory or browser storage (localStorage is encrypted best-effort)auth.on('login', ({ email }) => {/* ... */});
auth.on('tokenRefresh', () => {/* ... */});
auth.on('logout', () => {/* ... */});
Client retries once on 401 by calling /refresh-token silently.
getUser() caches profile; when offline it returns the last cached value.
Server endpoints (present in dev server):
POST /mfa/totp/enroll/start → { otpauthUrl, secret }POST /mfa/totp/verify { code } → { ok }POST /mfa/otp/send { channel: 'email'|'sms', to? } → { ok }POST /mfa/otp/verify { code } → { ok, accessToken?, refreshToken? }POST /passwordless/start { email } → { ok }POST /passwordless/verify { token } → tokensClient helpers (stubs): totpEnrollStart, totpVerify, otpSend, otpVerify, passwordlessStart, passwordlessVerify.
import { createAuthClient } from 'infinityauth';
const auth = createAuthClient({ baseURL, clientId });
const { verifier, challenge } = await auth.pkceStart?.();
// redirect user to your /authorize with code_challenge & method=S256
// after redirect back with ?code=...
await auth.authorizeWithCode?.({
code,
redirectUri: window.location.origin + '/callback',
codeVerifier: verifier
});
// After redirect back, exchange provider code at your server
await fetch('/social/token', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
tokenEndpoint: 'https://accounts.google.com/o/oauth2/token',
code,
clientId,
clientSecret,
redirectUri
})
});
// Start device code
const start = await fetch('/oauth/device/code', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ client_id: 'myapp' })
}).then(r => r.json());
// Show start.user_code to user, poll tokens:
const poll = await fetch('/oauth/token/device', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({
device_code: start.device_code,
client_id: 'myapp'
})
});
await auth.webauthnRegister('user@example.com');
const result = await auth.webauthnLogin('user@example.com');
storage: 'localStorage'./.well-known/jwks.json exposureEnvironment (server):
JWT_PRIVATE_KEY, JWT_PUBLIC_KEY, JWT_KID (optional; otherwise dev keys)REDIS_URL (optional for distributed rate limits)CORS_ORIGINSMIT © ashutosh0x
InfinityAuth client speaks simple REST by default. For OIDC providers (Auth0, Okta, Keycloak), point baseURL to your compat layer or expose matching endpoints:
POST /signup { email, password }POST /login { email, password }GET /me (bearer auth)POST /refresh-token { refreshToken }POST /logout (bearer auth)Optional Advanced:
POST /mfa/totp/enroll/startPOST /mfa/totp/verify { code }POST /mfa/otp/send { channel: 'email'|'sms', to? }POST /mfa/otp/verify { code }POST /passwordless/start { email }POST /passwordless/verify { token }auth.on('login', ({ email }) => console.log('logged in', email));
auth.on('tokenRefresh', () => console.log('token refreshed'));
auth.on('logout', () => console.log('logged out'));
const auth = createAuthClient({
baseURL,
clientId,
debug: true,
});
import { useEffect, useState } from 'react';
import { createAuthClient } from 'infinityauth';
const auth = createAuthClient({ baseURL: 'http://localhost:4000', clientId: 'web' });
export function App() {
const [me, setMe] = useState(null);
useEffect(() => { auth.getUser().then(setMe); }, []);
return (
<div>
{me ? (
<pre>{JSON.stringify(me, null, 2)}</pre>
) : (
<button onClick={async () => {
await auth.login('u@example.com', 'P@ssw0rd1');
setMe(await auth.getUser());
}}>
Login
</button>
)}
</div>
);
}
const { createAuthClient } = require('infinityauth');
const auth = createAuthClient({ baseURL: 'http://localhost:4000', clientId: 'server' });
async function demo() {
await auth.signup('u@example.com', 'P@ssw0rd1');
const me = await auth.getUser();
console.log(me);
}
demo();
credentials: true is set when needed./refresh-token responds and your refresh token is valid (not revoked/expired)./.well-known/jwks.json. Issuer must be infinity-auth, audience infinity-auth-users.// pages/api/me.ts
import type { NextApiRequest, NextApiResponse } from 'next';
export default async function handler(req: NextApiRequest, res: NextApiResponse) {
const hdr = req.headers.authorization || '';
if (!hdr.startsWith('Bearer ')) return res.status(401).end();
// Forward to InfinityAuth server
const r = await fetch(process.env.AUTH_URL + '/me', {
headers: { Authorization: hdr }
});
if (!r.ok) return res.status(401).end();
return res.status(200).json(await r.json());
}
const at = await auth.getUser()
.then(() => auth.refreshToken())
.then(t => t.accessToken);
await fetch('/graphql', {
method: 'POST',
headers: { 'Authorization': `Bearer ${at}` }
});
const at = await auth.refreshToken().then(t => t.accessToken);
const ws = new WebSocket(`wss://example/ws?token=${at}`);
/authorize and /oauth/tokenauth, oauth, oidc, jwt, infinityauth, authentication
FAQs
A comprehensive, secure, and developer-friendly authentication package
The npm package infinityauth receives a total of 0 weekly downloads. As such, infinityauth popularity was classified as not popular.
We found that infinityauth demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.
Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.