@elixpo/accounts

The official edge-safe TypeScript client for Elixpo Accounts. It discovers OAuth endpoints, creates S256 PKCE transactions, validates callbacks, rotates tokens, revokes access, and verifies signed access and ID tokens with JWKS.

Install

npm install @elixpo/accounts

Configure the client

Register an OAuth application first, then initialize one client in your server runtime. The issuer is public; the client secret and returned tokens are not.

import {
  createAccountsClient,
  parseAuthorizationCallback,
} from "@elixpo/accounts";

const accounts = createAccountsClient({
  issuer: "https://accounts.elixpo.com",
  clientId: process.env.ELIXPO_CLIENT_ID!,
  clientSecret: process.env.ELIXPO_CLIENT_SECRET,
  redirectUri: "https://example.com/auth/callback",
  audience: "example.com",
});

Start authorization

Persist the complete transaction in an encrypted, httpOnly, same-site session before redirecting. The optionalselect_account prompt lets a signed-in user choose which Elixpo account authorizes the application.

const { url, transaction } =
  await accounts.createAuthorizationRequest({
    scopes: ["openid", "profile", "email"],
    prompt: "select_account",
  });

// Store transaction in an encrypted, httpOnly session.
return Response.redirect(url);

Handle the callback

Read the stored transaction once, validate state, exchange the code with its PKCE verifier, and verify the ID token against the original nonce.

const { code } = parseAuthorizationCallback(
  request.url,
  transaction.state,
);

const tokens = await accounts.exchangeAuthorizationCode({
  code,
  codeVerifier: transaction.codeVerifier,
});

const identity = await accounts.verifyIdToken(
  tokens.idToken!,
  transaction.nonce,
);

Refresh and revoke

Refresh tokens rotate. Replace the stored value atomically and never continue using the previous token.

const rotated = await accounts.refresh(tokens.refreshToken);
// Atomically replace the old refresh token.
await accounts.revoke(rotated.refreshToken);

Security boundaries

• Keep client secrets, refresh tokens, transactions, and all returned tokens on the server.
• Store state, nonce, and the PKCE verifier together in an encrypted session with a short expiry.
• Set audience before callingverifyAccessToken.
• Let hosted Accounts pages collect passwords, OTPs, passkeys, MFA responses, consent, and account selection.

Choose your next reference

Read the OAuth flow for the wire protocol, the error reference for typed failures, or the webhook guide for lifecycle events.