PAYW Authentication centralizes and simplifies
the sign up/login process of every PAYW service.

---

JWT

PAYW Auth uses JSON Web Tokens to authenticate user identity.

Supported OAuth

• Google

Available Services

• saying.today

---

Auth API

• Sign Up / Login
• Verify Access Token
• Refresh Access Token
• Revoke Refresh Token

Sign Up / Login

Google

https://auth.payw.org/google/sign-up/:serviceName

Verify Access Token

https://auth.payw.org/verify

Headers

Field	Value
Authorization	Bearer {accessToken}

Response

200

{
  userID: number,
  iat: number,
  exp: number
}

401 (Unauthorized)

null

// or

{
  expired: true
}

Refresh Access Token

https://auth.payw.org/refresh

Headers

Field	Value
Authorization	Bearer {refreshToken}

Response

200

{
  accessToken: string
}

401 (Unauthorized)

null

Revoke Refresh Token

Remove the previous refresh token and re-sign the new refresh token.

https://auth.payw.org/revoke

Headers

Field	Value
Authorization	Bearer {refreshToken}

Response

200

{
  refreshToken: string
}

401 (Unauthorized)

null

PAYW Auth Client

It is a module which includes several helper methods and most importantly automates the authentication process by following the flow below.

• Verify the access token.
  • If unauthorized, return false.
  • If authorized, return the 200 response of Verify Access Token.
  • If the access token has expired, try to refresh the access token using the refresh token.
    • If unauthorized, return false.
    • If authorized, override the access token in cookie then go back to the first stage and verify again with the new token.

If you don't use the PAYW Auth Client, you have to manually implement this flow by yourself.

Installation

Node.js

npm install @payw/auth

import { PAYWAuth } from '@payw/auth'

const paywAuth = PAYWAuth(req, res)

paywAuth.verify().then((result) => {
  // Do something
})

PAYW Auth Client API

PAYWAuth(req: IncomingMessage, res: ServerResponse): PAYWAuthInstance

import { PAYWAuth } from '@payw/auth'

const paywAuth = PAYWAuth(req, res)

PAYWAuthInstance.setTokens({ accessToken?: string, refreshToken?: string }): void`

Deprecated. Use storeTokens instead.

PAYWAuthInstance.storeTokens({ accessToken?: string, refreshToken?: string }): void

Store access token and refresh token in httpOnly cookies.

paywAuth.storeTokens({ accessToken: '', refreshToken: '' })

PAYWAuthInstance.verify(): Promise<AuthData | false>

Verify the tokens through the PAYW Authentication server.

paywAuth.verify()

PAYWAuthInstance.redirect(location: string): void

Redirect to the given location.

paywAuth.redirect('/')

getLoginURL(service: AvailableService): string

Get the sign up/login URL of a service.

import { PAYWAuth, getLoginURL } from '@payw/auth'

const paywAuth = PAYWAuth(req, res)

paywAuth.redirect(getLoginURL('saying.today'))

It's available in the browsers.