The auth0-spa-js repository is a JavaScript/TypeScript SDK for authenticating Single Page Applications (SPAs) with Auth0. It implements the Authorization Code Flow with PKCE, providing methods for user login (redirect and popup), silent token acquisition, token refresh, logout, and user information retrieval. The SDK includes advanced features such as Multi-Factor Authentication (MFA), passkey/WebAuthn support, DPoP (Demonstrating Proof of Possession) for token security, Multi-Resource Refresh Tokens (MRRT), and custom token exchange per RFC 8693. Architecture-wise, it is modular with separate concerns: core authentication (Auth0Client), caching (memory and localStorage), storage (cookies and session storage), Web Worker for token operations, and specialized modules for MFA, passkeys, and account management. Key entry points include the `createAuth0Client` factory function and the `Auth0Client` class. The library relies on @auth0/auth0-auth-js for low-level Auth0 interactions and browser-tabs-lock for cross-tab synchronization.
This is the official Auth0 React SDK (`@auth0/auth0-react`), a client-side library that provides React bindings for Auth0 authentication. It wraps the core `@auth0/auth0-spa-js` library and exposes a React-friendly API via context, hooks, and higher-order components. The architecture follows a standard React context provider pattern: `Auth0Provider` wraps the application tree, and `useAuth0` (or `useAuth0Suspense`) provides authentication state and methods (login, logout, token management, MFA, passkeys). The SDK supports OAuth2 Authorization Code Grant with PKCE, refresh token rotation, DPoP, and custom token exchange. It is designed for single-page applications and is compatible with React 19+, including Next.js App Router (via `'use client'` directive injection). Key entry points include `Auth0Provider` (the root provider), `useAuth0` (primary hook), `useAuth0Suspense` (Suspense-enabled variant), `withAuthenticationRequired` (HOC for route protection), and `withAuth0` (legacy HOC). The SDK manages authentication state through a reducer (`src/reducer.tsx`) and provides a rich error hierarchy (`OAuthError`, `MfaRequiredError`, etc.). External dependencies are minimal: React, ReactDOM, and `@auth0/auth0-spa-js`. The codebase is well-tested with Jest unit tests (using a manual mock for the underlying SDK) and Cypress integration tests against a live Auth0 tenant. The SDK demonstrates strong engineering practices: typed interfaces, memoized context values, structured error handling, and a clear separation of concerns between the provider, hooks, and HOCs. It includes generated TypeDoc documentation and example applications for Vite, Gatsby, and Next.js. While the library is tightly coupled to the Auth0 ecosystem, its patterns (context-based auth, Suspense integration, error hierarchy) are reusable in other authentication contexts.
This is an Angular SDK library (`@auth0/auth0-angular`) that integrates Auth0 authentication (OAuth2/OIDC) into Angular single-page applications. It wraps the Promise-based `@auth0/auth0-spa-js` into Angular's reactive ecosystem using RxJS Observables, dependency injection, and Angular Router. The library provides core authentication flows (redirect/popup login, logout, token management), route protection via guards, automatic bearer token injection via HTTP interceptors, and additional features such as MFA, passkeys (WebAuthn), enterprise account linking, custom token exchange, and a MyAccount API client. It supports both traditional NgModule-based and modern standalone (functional) Angular patterns. The playground application included serves as a development and e2e test harness with a local OIDC provider. The architecture is clean, well-tested, and follows Angular best practices, though the core logic is delegated to the underlying Auth0 SPA SDK.