---
name: bijection-oauth-provider
description: "Evaluate and integrate the OAuth Provider component with Bijection."
---

# OAuth Provider

OAuth 2.1 / OpenID Connect Provider for Bijection Auth (Beta).

- Package: @bijectionhq/oauth-provider
- Category: Authentication
- Status: Preview
- License: Apache-2.0
- Bijection source (repository access required): https://github.com/bijectionhq/oauth-provider/tree/43fafe84f04ee063a3c92b397829f4387f7e32c8
- Upstream: https://github.com/codefox-inc/convex-oauth-provider/tree/50d547117d2dc0ce3d051b187508d8238c5cc7d2
- Documentation: https://docs.bijection.com/components/using
- Directory: https://bijection.com/components/oauth-provider

## Get the source

Bijection repository access is required. Request access at https://bijection.com/contact.

```sh
git clone https://github.com/bijectionhq/oauth-provider.git
cd oauth-provider
git checkout 43fafe84f04ee063a3c92b397829f4387f7e32c8
```

## Before using this component

Read the package README at the recorded revision for setup, dependencies, and API examples. Upstream documentation describes the original package and may differ from the Bijection adaptation. This is a source candidate for evaluation. Catalog inclusion does not establish npm availability or runtime qualification. Check compatibility with your SDK and deployment before adoption. External providers run their own compute.

## Integration workflow

1. Read the source README and package manifest at the recorded revision.
2. Confirm the required SDK, dependency availability, and runtime compatibility.
3. Follow the component's documented setup and configuration. Never invent an npm install command from a catalog package name.
4. Keep credentials in the project's existing secret store.
5. Follow the project's execution rules for verification and report what was actually checked.

## Original upstream skill

The following guidance describes @codefox-inc/oauth-provider. Its installation commands and APIs refer to the upstream package. Evaluate compatibility with the Bijection source separately.


> Agents: read this skill fully before writing code that uses oauth-provider. Follow the installation and configuration steps exactly.

# oauth-provider

## Instructions

Turns your Convex app into a fully compliant OAuth 2.1 / OpenID Connect provider with Dynamic Client Registration support. Implements secure authorization flows with PKCE enforcement, JWT access tokens with RS256 signing, and refresh token rotation. Enables MCP client integration and third-party app authorization while maintaining strict security controls including token hashing and redirect URI validation.

### Installation

```bash
npm install @codefox-inc/oauth-provider
```

Current npm version: `@codefox-inc/oauth-provider@0.4.2`

## Use cases

- **Connect to MCP clients** like Claude Desktop or ChatGPT that require OAuth 2.1 provider capabilities for app integration
- **Enable third-party integrations** by allowing external applications to authenticate users and access your Convex app's resources with scoped permissions
- **Add OAuth provider functionality** to existing Convex Auth or Better Auth setups without rebuilding authentication infrastructure
- **Support automatic client registration** through Dynamic Client Registration for seamless developer onboarding
- **Implement secure API access** with JWT tokens and refresh token rotation for long-lived integrations

## How it works

The component registers as a Convex component in your `convex.config.ts` and exposes OAuth 2.1 endpoints through HTTP routes. You configure an `OAuthProvider` instance with RSA keys (can reuse existing Convex Auth keys) and a `getUserId` hook for authentication, then use `registerOAuthRoutes()` to automatically set up all required endpoints including authorization, token, JWKS, and OpenID Connect discovery.

The authorization flow enforces PKCE with S256 method and validates redirect URIs against registered clients. Access tokens are issued as RS256 JWTs while authorization codes and tokens are stored as SHA-256 hashes for security. The component supports standard OAuth scopes (`openid`, `profile`, `email`) and requires `offline_access` for refresh token issuance.

Client management happens through database mutations with optional Dynamic Client Registration enabled via configuration. The component provides helper functions like `isOAuthToken()` and `getOAuthClientId()` to distinguish OAuth tokens from session tokens in your application logic, enabling different handling for third-party clients versus first-party users.

## When NOT to use

- When a simpler built-in solution exists for your specific use case
- If you are not using Convex as your backend
- When the functionality provided by oauth-provider is not needed

## Resources

- [npm package](https://www.npmjs.com/package/%40codefox-inc%2Foauth-provider)
- [GitHub repository](https://github.com/codefox-inc/convex-oauth-provider)
- [Live demo](https://oauth-provider-example.codefox-inc.workers.dev/)
- [Convex Components Directory](https://www.convex.dev/components/codefox-inc/oauth-provider)
- [Convex documentation](https://docs.convex.dev)