OpenID Connect auth

Package

@mercury-fw/auth-oidc

Role

Auth provider

Version

0.2.1

bun add @mercury-fw/auth-oidc

Variable	What it is
OIDC_ISSUER	Required. the OpenID Connect issuer's URL, as tokens carry it in iss (https://<instance>.zitadel.cloud)
OIDC_AUDIENCE	Required. the client id the UI calling the HTTP surface is registered with on the issuer (tokens carry it in aud)

OpenID Connect is the standard most login services speak: a person signs in there, the service gives your chat interface a signed token, and the interface sends it with every request (Authorization: Bearer <token>). This provider checks that token (signature, issuer, audience, expiry) and turns it into the caller’s identity, oidc:<their id at the service>. Anything else is refused.

mercury.config.ts

import { oidcAuth } from "@mercury-fw/auth-oidc";

auth: oidcAuth,

OIDC_ISSUER is the login service’s address, exactly as tokens carry it, and OIDC_AUDIENCE the id your interface is registered with there, so a token the same service made for another application is refused. Roles aren’t read from the token: they come from the directory.

Several login services

One provider serves one service. To accept people from two, give the second a provider of its own with a name, and list both:

mercury.config.ts

import { createOidcAuth, oidcAuth } from "@mercury-fw/auth-oidc";

auth: [oidcAuth, createOidcAuth({ name: "company" })],

The named one reads OIDC_COMPANY_ISSUER and OIDC_COMPANY_AUDIENCE. Someone signing in through both services is two people to Mercury, unless a directory or a link joins them.