passport-discord-token

Passport strategy for authorizing users with Discord access tokens using the OAuth 2.0 API.

This module lets you authenticate using Discord in your Node.js applications. By plugging into Passport, Discord authentication can be easily and unobtrusively integrated into any application or framework that supports Connect-style middleware, including Express.

Note:

This strategy is primarily intended for authorizing requests from native clients that must obtain a Discord access token using client-side flows (e.g. Discord Game SDK, PKCE) before authenticating with your Node.js backend.

For browser clients, a strategy like passport-discord is better suited.

Installation

npm install passport-discord-token

yarn add passport-discord-token

Usage

Create an Application

Before using passport-discord-token, you must register an application with Discord. If you have not already done so, create an application in the Discord Developer Portal. Your application will be issued a client ID, which need to be provided to the strategy.

Configure Strategy

The strategy requires a verify callback, which accepts these credentials and calls done providing a user, as well as options specifying a clientID and clientSecret.

const DiscordTokenStrategy = require('passport-discord-token');

passport.use(new DiscordTokenStrategy({
    clientID: DISCORD_CLIENT_ID, /* required */
    clientSecret: DISCORD_CLIENT_SECRET, /* optional (supports refresh token exchange) */
}, (accessToken, refreshToken, profile, done) => {
    User.findOrCreate({discordId: profile.id}, (error, user) => {
        return done(error, user);
    });
}));

Authenticate Requests

Use passport.authenticate(), specifying the 'discord-token' strategy, to authenticate requests.

For example, as route middleware in an Express application:

app.post('/auth/discord-token', 
    passport.authenticate('discord-token'),
    (req, res) => {
        res.send(req.user ? 200 : 401);
    });

Client-Side

Configure Client

Your client must first obtain an access token from Discord's OAuth 2.0 endpoints before making a request to this strategy (see note). Here are some options:

Discord Game SDK - Call ApplicationManager.GetOAuth2Token to obtain a token directly from your game.

Authorization Code Flow

• with PKCE (RFC7636) - A secure means for obtaining an access token from a native client. Although this modified flow is supported by Discord's API, documentation is pending.

Implicit Grant

Client Requests

Clients can send a request to a route that uses the passport-discord-token strategy by providing an access token in the request's body, query parameters, or headers.

Body:

POST /auth/discord-token
access_token=<TOKEN>

Query Parameter:

GET /auth/discord-token?access_token=<TOKEN>

Authorization Header:

GET /auth/discord-token
Authorization: Bearer <TOKEN>

License

MIT License