A lightweight JavaScript client for the InfinityAuth API. It supports signup, login, refresh token rotation, logout, and fetching the current user profile.

Installation

npm install infinityauth

After install, you'll see a notice: "package author: ashutosh0x".

Quick Start

import { createAuthClient } from 'infinityauth';

const auth = createAuthClient({
  baseURL: 'http://localhost:4000',
  clientId: 'your-client-id',
});

// Signup
await auth.signup('user@example.com', 'StrongP@ssw0rd!');

// Login
const { accessToken, refreshToken } = await auth.login('user@example.com', 'StrongP@ssw0rd!');

// Current user
const me = await auth.getUser();

// Refresh
const newTokens = await auth.refreshToken();

// Logout
await auth.logout();

Role helper

const isAdmin = (auth).hasRole?.('admin');

Offline-first profile

// If offline, getUser will return last cached profile
const me = await auth.getUser();

API

createAuthClient(config) returns an AuthClient
- config.baseURL: string (required) – Base URL of InfinityAuth API
- config.clientId: string (required)
- config.clientSecret: string (optional)
- config.storage: 'memory' | 'localStorage' (optional)

AuthClient methods

signup(email, password) → { accessToken, refreshToken, expiresIn }
login(email, password) → { accessToken, refreshToken, expiresIn }
getUser() → { id, email, role } | null
refreshToken() → { accessToken, refreshToken, expiresIn }
logout() → void

Configuration

createAuthClient({
  baseURL: 'http://localhost:4000',
  clientId: 'web',
  clientSecret?: 'optional',
  storage?: 'memory' | 'localStorage' | 'indexeddb',
  debug?: true,
  fetchAdapter?: (input, init) => fetch(input, init),
});

debug: logs requests and token refresh attempts
fetchAdapter: plug Axios/fetch polyfills
storage: memory or browser storage (localStorage is encrypted best-effort)

Events / Hooks

auth.on('login', ({ email }) => {/* ... */});
auth.on('tokenRefresh', () => {/* ... */});
auth.on('logout', () => {/* ... */});

Client retries once on 401 by calling /refresh-token silently.
getUser() caches profile; when offline it returns the last cached value.

MFA & Passwordless (optional)

Server endpoints (present in dev server):

POST /mfa/totp/enroll/start → { otpauthUrl, secret }
POST /mfa/totp/verify { code } → { ok }
POST /mfa/otp/send { channel: 'email'|'sms', to? } → { ok }
POST /mfa/otp/verify { code } → { ok, accessToken?, refreshToken? }
POST /passwordless/start { email } → { ok }
POST /passwordless/verify { token } → tokens

Client helpers (stubs): totpEnrollStart, totpVerify, otpSend, otpVerify, passwordlessStart, passwordlessVerify.

Notes

Client stores tokens in memory by default. For browser persistence, pass storage: 'localStorage'.
Ensure your server is configured for CORS and uses RS256 JWTs with a JWKS endpoint.
Never commit private keys; use environment variables in production.

Server Security Model (InfinityAuth dev server)

JWT: RS256 with /.well-known/jwks.json exposure
Refresh tokens: hashed (SHA-256), expiresAt enforced, rotation on refresh, reuse detection (revokes all tokens on reuse)
Rate limiting: express-rate-limit; optional Redis store via REDIS_URL
Argon2id password hashing

Environment (server):

JWT_PRIVATE_KEY, JWT_PUBLIC_KEY, JWT_KID (optional; otherwise dev keys)
REDIS_URL (optional for distributed rate limits)
CORS_ORIGINS

License

Provider/OIDC Compatibility

InfinityAuth client speaks simple REST by default. For OIDC providers (Auth0, Okta, Keycloak), point baseURL to your compat layer or expose matching endpoints:

POST /signup { email, password }
POST /login { email, password }
GET /me (bearer auth)
POST /refresh-token { refreshToken }
POST /logout (bearer auth)

Optional Advanced:

POST /mfa/totp/enroll/start
POST /mfa/totp/verify { code }
POST /mfa/otp/send { channel: 'email'|'sms', to? }
POST /mfa/otp/verify { code }
POST /passwordless/start { email }
POST /passwordless/verify { token }

Events & Debugging

auth.on('login', ({ email }) => console.log('logged in', email));
auth.on('tokenRefresh', () => console.log('token refreshed'));
auth.on('logout', () => console.log('logged out'));

const auth = createAuthClient({
  baseURL,
  clientId,
  debug: true,
});

Framework Examples

React

import { useEffect, useState } from 'react';
import { createAuthClient } from 'infinityauth';

const auth = createAuthClient({ baseURL: 'http://localhost:4000', clientId: 'web' });

export function App(){
  const [me, setMe] = useState(null);
  useEffect(() => { auth.getUser().then(setMe); }, []);
  return (
    <div>
      {me? <pre>{JSON.stringify(me,null,2)}</pre> : <button onClick={async()=>{ await auth.login('u@example.com','P@ssw0rd1'); setMe(await auth.getUser()); }}>Login</button>}
    </div>
  );
}

Node/Express

const { createAuthClient } = require('infinityauth');
const auth = createAuthClient({ baseURL: 'http://localhost:4000', clientId: 'server' });

async function demo(){
  await auth.signup('u@example.com','P@ssw0rd1');
  const me = await auth.getUser();
  console.log(me);
}
demo();

Roadmap

Full OAuth2/OIDC surface (PKCE, Device Code)
WebAuthn MFA/passwordless
IndexedDB storage option
API Playground and examples repo

FAQs

What is infinityauth?

Is infinityauth popular?

Is infinityauth well maintained?

Package last updated on 14 Aug 2025

infinityauth

InfinityAuth JS Client