+
+# AuthKit Provider
+
+## Resources
+
+- [WorkOS AuthKit documentation](https://workos.com/docs/reference/user-management)
+
+## Setup
+
+### Callback URL
+
+
+
+
+```bash
+https://example.com/api/auth/callback/authkit
+```
+
+
+
+
+```bash
+https://example.com/auth/callback/authkit
+```
+
+
+
+
+```bash
+https://example.com/auth/callback/authkit
+```
+
+
+
+
+### Environment Variables
+
+```
+AUTH_AUTHKIT_ID
+AUTH_AUTHKIT_SECRET
+```
+
+### Configuration
+
+
+
+
+```ts filename="/auth.ts"
+import NextAuth from "next-auth"
+import AuthKit from "next-auth/providers/authkit"
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+ providers: [AuthKit({ authkitProvider: "authkit", screenHint: "sign-in" })],
+})
+```
+
+
+
+
+```ts filename="/src/routes/plugin@auth.ts"
+import { QwikAuth$ } from "@auth/qwik"
+import AuthKit from "@auth/qwik/providers/authkit"
+
+export const { onRequest, useSession, useSignIn, useSignOut } = QwikAuth$(
+ () => ({
+ providers: [AuthKit({ authkitProvider: "authkit", screenHint: "sign-in" })],
+ })
+)
+```
+
+
+
+
+```ts filename="/src/auth.ts"
+import { SvelteKitAuth } from "@auth/sveltekit"
+import AuthKit from "@auth/sveltekit/providers/authkit"
+
+export const { handle, signIn, signOut } = SvelteKitAuth({
+ providers: [AuthKit({ authkitProvider: "authkit", screenHint: "sign-in" })],
+})
+```
+
+
+
+
+```ts filename="/src/app.ts"
+import { ExpressAuth } from "@auth/express"
+import AuthKit from "@auth/express/providers/authkit"
+
+app.use(
+ "/auth/*",
+ ExpressAuth({
+ providers: [AuthKit({ authkitProvider: "authkit", screenHint: "sign-in" })],
+ })
+)
+```
+
+
+
diff --git a/packages/core/src/providers/authkit.ts b/packages/core/src/providers/authkit.ts
new file mode 100644
index 0000000000..16aca5c2c3
--- /dev/null
+++ b/packages/core/src/providers/authkit.ts
@@ -0,0 +1,91 @@
+/**
+ * @module providers/authkit
+ */
+import { JsonObject } from "oauth4webapi"
+import type { OAuthConfig, OAuthUserConfig } from "./index.js"
+/**
+ * - {@link https://api.workos.com/user_management/users/( + options: OAuthUserConfig
& { + authkitProvider?: + | "authkit" + | "GoogleOAuth" + | "AppleOAuth" + | "MicrosoftOAuth" + | "GitHubOAuth" + screenHint?: "sign-in" | "sign-up" + } +): OAuthConfig
{ + return { + id: "authkit", + name: "AuthKit", + type: "oauth", + authorization: { + url: "https://api.workos.com/user_management/authorize", + params: { + provider: options.authkitProvider ?? "authkit", + screen_hint: options.screenHint ?? "sign-up", + }, + }, + token: { + url: "https://api.workos.com/user_management/authenticate", + async conform(res: Response) { + const data = await res.json() + if (data.token_type === "bearer") { + console.warn( + "token_type is 'bearer'. Redundant workaround, please open an issue." + ) + return res + } + return Response.json({ ...data, token_type: "bearer" }, res) + }, + }, + client: { + token_endpoint_auth_method: "client_secret_post", + }, + userinfo: { + url: "https://api.workos.com/user_management/users", + async request({ tokens, provider }) { + const response = await fetch( + `${provider.userinfo?.url}/${(tokens.user as JsonObject)?.id}`, + { + headers: { + Authorization: `Bearer ${provider.clientSecret}`, + }, + } + ) + return response.json() + }, + }, + profile(profile) { + let name = null + if (profile.first_name) { + name = profile.first_name + } + if (profile.last_name) { + name = name ? `${name} ${profile.last_name}` : profile.last_name + } + return { + id: profile.id, + name, + email: profile.email, + image: profile.profile_picture_url ?? null, + } + }, + style: { bg: "#6363f1", text: "#fff" }, + options, + } +}