Next.js (App Router)

SENSECRYPT_ISSUER=https://<your-tenant>.<domain>
SENSECRYPT_CLIENT_ID=your_client_id
# Only for a Confidential client. Omit for a SPA/public client.
SENSECRYPT_CLIENT_SECRET=your_client_secret
SENSECRYPT_REDIRECT_URI=http://localhost:3000/api/auth/callback
# Any long random string — signs the short-lived PKCE/state cookie.
AUTH_COOKIE_SECRET=please-generate-32-plus-random-bytes

import * as client from "openid-client";

let cached: client.Configuration | undefined;

export async function getConfig(): Promise<client.Configuration> {
  if (cached) return cached;
  // Discovery reads {issuer}/.well-known/openid-configuration and picks up
  // authorization_endpoint, token_endpoint, jwks_uri, etc. automatically.
  cached = await client.discovery(
    new URL(process.env.SENSECRYPT_ISSUER!),
    process.env.SENSECRYPT_CLIENT_ID!,
    process.env.SENSECRYPT_CLIENT_SECRET, // undefined for a SPA/public client
  );
  return cached;
}

import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import * as client from "openid-client";
import { getConfig } from "@/lib/sensecrypt";

export async function GET() {
  const config = await getConfig();

  const code_verifier = client.randomPKCECodeVerifier();
  const code_challenge = await client.calculatePKCECodeChallenge(code_verifier);
  const state = client.randomState();

  const authUrl = client.buildAuthorizationUrl(config, {
    redirect_uri: process.env.SENSECRYPT_REDIRECT_URI!,
    scope: "openid profile email",
    code_challenge,
    code_challenge_method: "S256", // SenseCrypt requires S256
    state,
  });

  // Persist the verifier + state for the callback. Use an encrypted/HTTP-only
  // cookie; a signed session store works too.
  const jar = await cookies();
  jar.set("sc_pkce", JSON.stringify({ code_verifier, state }), {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    maxAge: 600,
    path: "/",
  });

  redirect(authUrl.href);
}

export default function Home() {
  return <a href="/api/auth/login">Sign in with SenseCrypt</a>;
}

import { cookies } from "next/headers";
import { redirect } from "next/navigation";
import * as client from "openid-client";
import { getConfig } from "@/lib/sensecrypt";

export async function GET(request: Request) {
  const config = await getConfig();

  const jar = await cookies();
  const raw = jar.get("sc_pkce")?.value;
  if (!raw) return new Response("Missing PKCE state", { status: 400 });
  const { code_verifier, state } = JSON.parse(raw);

  // Exchanges the code and validates the id_token (signature, iss, aud, exp).
  const tokens = await client.authorizationCodeGrant(
    config,
    new URL(request.url),
    { pkceCodeVerifier: code_verifier, expectedState: state },
  );

  const claims = tokens.claims()!; // sub, iss, aud, exp, plus profile/email
  jar.delete("sc_pkce");

  // Establish YOUR app session here (e.g. an encrypted session cookie keyed
  // on claims.sub — the stable per-tenant user id). Storing raw tokens shown
  // for illustration only.
  jar.set("sc_session", JSON.stringify({ sub: claims.sub, email: claims.email }), {
    httpOnly: true,
    secure: process.env.NODE_ENV === "production",
    sameSite: "lax",
    path: "/",
  });

  redirect("/dashboard");
}

curl -X POST {token_endpoint} \
  -d grant_type=authorization_code \
  -d code={code} \
  -d redirect_uri={redirect_uri} \
  -d client_id={client_id} \
  -d code_verifier={code_verifier}
  # confidential clients add: -d client_secret={client_secret}

{
  "access_token": "eyJ…",
  "id_token": "eyJ…",
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid profile email"
}

npm run dev

import { cookies } from "next/headers";

export async function GET() {
  const jar = await cookies();
  const session = jar.get("sc_session")?.value;
  return Response.json(session ? JSON.parse(session) : { anonymous: true });
}