skills.rest
overlens
overlensOFFICIAL
Explore all skills by this author →
WebsiteGitHub

idp-integrate-oauth-web

Implements OAuth 2.1 Authorization Code with PKCE login flows against the Overlens IDP for server-side web backends.

Updated Jul 24, 2026
Search Tags:#authentication#oauth#nextjs#nestjs#sso#pkce#identity provider
One-click install
npx skills add https://github.com/overlens/claude-marketplace --skill idp-integrate-oauth-web-overlens
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: idp-integrate-oauth-web
Source: https://github.com/overlens/claude-marketplace/tree/main/plugins/idp-integration/skills/idp-integrate-oauth-web
Command: npx skills add https://github.com/overlens/claude-marketplace --skill idp-integrate-oauth-web-overlens

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Wiring login, signup, silent refresh, and logout against the Overlens Identity Provider involves many subtle failure points — PKCE generation, state validation, exact redirect_uri matching, cookie maxAge unit bugs, and refresh token rotation. This Skill gives developers copy-paste templates and framework-specific guides so the integration is correct on the first pass. ## Core Features & Use Cases - Framework-specific templates: Ready-to-copy handlers for Next.js App Router (Server Actions and Route Handlers), NestJS BFF, and Express/Hono/Fastify, plus a generic guide for Rails, Django, ASP.NET, and other server-side frameworks. - Complete OAuth flow coverage: PKCE generation, login/signup redirects, callback code exchange with Basic Auth, silent refresh with token rotation, and OIDC RP-Initiated Logout via the end_session_endpoint. - Pitfall and troubleshooting references: A symptom-to-cause-to-fix guide covering redirect_uri mismatches, maxAge unit bugs, state validation failures, and refresh token reuse. - Use Case: A developer with a NestJS backend copies the auth controller and IDP client service templates, sets six environment variables, and has working Overlens login, refresh, and logout in one session. ## Quick Start Ask the assistant to integrate Overlens login into your web backend, mentioning your framework such as Next.js, NestJS, or Express.

Frequently Asked Questions about idp-integrate-oauth-web

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I integrate Overlens IDP login into a Next.js app?▼

Copy the PKCE utilities, Server Actions for login and signup redirects, the callback Route Handler, and the refresh route from the templates. Set the ACCOUNTS_URL, IDP_BASE_URL, IDP_CLIENT_ID, IDP_CLIENT_SECRET, and IDP_REDIRECT_URI environment variables, ensuring the redirect URI byte-matches the registered value.

How does OAuth PKCE token exchange work with a confidential client?▼

The backend redirects the browser to the Accounts login page with a code_challenge, then on callback POSTs the code and code_verifier to the IDP token endpoint using HTTP Basic Auth with client_id and client_secret. The IDP returns an access token valid 15 minutes and a refresh token valid 30 days.

Can I use this flow with Express, NestJS, Rails, or Django?▼

Yes, the flow is framework-neutral and the skill includes dedicated guides for Express, Hono, Fastify, and NestJS plus a generic guide for Rails, Django, ASP.NET, Spring, and Go. Only the cookie and HTTP API names differ; the PKCE and token exchange logic is identical.

Why does the user get logged out immediately after login?▼

The most common cause is cookie maxAge in the wrong unit: Express and NestJS take milliseconds while Rails, Django, Hono, and Fastify take seconds. Passing 900 to Express sets Max-Age to zero and the browser deletes the cookie instantly; use 900000 instead.

How do I implement logout with the Overlens IDP?▼

Clear your own session cookies, then send the browser via a top-level navigation to the IDP end_session_endpoint at GET /auth/logout with client_id, a registered post_logout_redirect_uri, and state. Never use fetch, since only a navigation carries the IDP first-party cookies needed to end the SSO session.

When should I not use this web BFF integration skill?▼

Do not use it for pure SPAs or mobile apps without a backend, which are public clients needing PKCE-only flows, nor for resource servers that only validate JWTs, nor for machine-to-machine service flows. Dedicated skills cover each of those cases.

Related Skills

Explore More Software Engineering Skills→
hexlet-volunteershexlet-volunteers
113

socialite-development

Automate OAuth social authentication flows with Laravel Socialite.

Official
Intermediate
wildbitcawildbitca
1

cloudflare-workers-auth

Validate JWTs at the edge for Cloudflare Workers using jose and Supabase JWKS.

Official
Advanced
rayven122rayven122

tumiki-custom-mcp-server-feature

Implement a custom MCP server unifying multiple server templates with OAuth authentication.

Official
Advanced
Prathamesh-chougale-17Prathamesh-chougale-17
1

nextjs-app-router-patterns

Provide Next.js 14+ App Router patterns for Server Components, streaming, and parallel routes.

Community
Advanced