scg-auth

Live Demo

How the demo works

The demo runs two Node.js servers entirely on your machine — no Google, no GitHub, no third-party involved.

localhost:3000          localhost:4000
(demo-app.js)           (my-oauth-server.js)
using scg-auth          YOUR OAuth 2.0 server

---

Run it locally

Open two terminals:

# Terminal 1 — start YOUR OAuth server
cd scg-auth
node examples/my-oauth-server.js

# Terminal 2 — start the demo app (uses scg-auth)
cd scg-auth
node examples/demo-app.js

Then open http://localhost:3000.

---

What happens step by step

Step 1 — You click Login

demo-app.js calls client.generateAuthUrl({ pkce: true }).

scg-auth automatically:

• Generates a random state (CSRF protection)
• Generates a random code_verifier (PKCE)
• Computes code_challenge = SHA-256(code_verifier) — Base64url encoded
• Builds the full URL: http://localhost:4000/authorize?client_id=...&state=...&code_challenge=...

Your browser is redirected to that URL.

---

Step 2 — Your OAuth server shows a login form

my-oauth-server.js receives the request, stores the OAuth params (state, PKCE challenge, scopes) in memory, and shows an email input form.

---

Step 3 — You enter your email → OTP appears on screen

The server looks up your email in its user list, generates a 6-digit one-time code, and shows it directly on the page in a large green box.

!!! info “In a real deployment” Replace the on-screen display with an email/SMS send. The rest of the flow is identical.

---

Step 4 — You click Verify

The server:

1. Validates the OTP (5-minute expiry)
2. Issues a short-lived authorization code
3. Redirects your browser to http://localhost:3000/callback?code=XYZ&state=ABC

---

Step 5 — scg-auth exchanges the code

demo-app.js calls client.exchangeCode(code, { state }).

scg-auth automatically:

• Validates state — throws if it doesn’t match (CSRF protection)
• POSTs to /token with code, client_id, redirect_uri, and code_verifier

my-oauth-server.js:

• Verifies the code_verifier against the stored code_challenge (PKCE check)
• Issues access_token + refresh_token

---

Step 6 — Profile displayed

demo-app.js calls GET /me with the Bearer token. Your server returns the user profile. The page shows:

{
  "name": "Harry Thapa",
  "email": "hemantthapa1998@gmail.com",
  "phone": "+447752106224",
  "sub": "usr_harry_001",
  "scope": "openid email profile"
}

---

Why this proves scg-auth is generic

The only config that makes it point at YOUR server:

const client = new SCGAuth({
  authorizationUrl: "http://localhost:4000/authorize", // your server
  tokenUrl: "http://localhost:4000/token", // your server
  // ...
});

Change those two URLs to any OAuth 2.0 provider and the library works identically.

This site is open source. Improve this page.