Use any OpenID Connect library

npm init -y && npm pkg set type=module && npm install openid-client

// oidc-app.ts: sign in through OpenID Connect with a stock library (openid-client v6).
// npm install openid-client; "type": "module" in package.json; Node 24+:
// ACCOUNTS_APP_ID=briefcase ACCOUNTS_APP_SECRET=sa_app_… node oidc-app.ts, then open http://localhost:3000/login
import { createServer } from "node:http";
import * as oidc from "openid-client";

const ISSUER = new URL(process.env.ACCOUNTS_URL ?? "https://accounts.teamofsilicons.com");
const APP_ID = process.env.ACCOUNTS_APP_ID ?? "briefcase"; // your client_id
const APP_SECRET = process.env.ACCOUNTS_APP_SECRET ?? ""; // your client_secret
const PORT = Number(process.env.PORT ?? 3000);
const REDIRECT_URI = `http://localhost:${PORT}/callback`; // one of the app's redirect_uris

// Reads /.well-known/openid-configuration once. id_tokens are signed with EdDSA (Ed25519).
const config = await oidc.discovery(
  ISSUER,
  APP_ID,
  APP_SECRET,
  undefined,
  ISSUER.protocol === "http:" ? { execute: [oidc.allowInsecureRequests] } : undefined, // a local http stack only
);

const pending = new Map<string, { verifier: string; nonce: string }>(); // state → PKCE verifier + nonce

createServer(async (req, res) => {
  const url = new URL(req.url ?? "/", `http://localhost:${PORT}`);
  if (url.pathname === "/login") {
    const state = oidc.randomState();
    const nonce = oidc.randomNonce();
    const verifier = oidc.randomPKCECodeVerifier();
    pending.set(state, { verifier, nonce });
    const authorize = oidc.buildAuthorizationUrl(config, {
      redirect_uri: REDIRECT_URI,
      scope: "openid email",
      state,
      nonce,
      code_challenge: await oidc.calculatePKCECodeChallenge(verifier),
      code_challenge_method: "S256",
    });
    res.writeHead(302, { Location: authorize.href, "Set-Cookie": `signin_state=${state}; HttpOnly; SameSite=Lax; Path=/; Max-Age=3600` });
    return res.end();
  }
  if (url.pathname === "/callback") {
    const state = url.searchParams.get("state") ?? "";
    const cookieState = /(?:^|;\s*)signin_state=([^;]+)/.exec(req.headers.cookie ?? "")?.[1];
    const started = pending.get(state);
    pending.delete(state);
    if (!started || cookieState !== state) return res.writeHead(400).end("Unknown sign-in: start again at /login");
    try {
      // Checks state, exchanges the code with PKCE, validates the id_token (EdDSA, iss, aud, exp, nonce).
      const tokens = await oidc.authorizationCodeGrant(config, url, {
        pkceCodeVerifier: started.verifier,
        expectedState: state,
        expectedNonce: started.nonce,
        idTokenExpected: true,
      });
      const claims = tokens.claims()!; // claims.sub is the account uuid: key your user on it
      const userinfo = await oidc.fetchUserInfo(config, tokens.access_token, claims.sub);
      res.writeHead(200, { "Content-Type": "application/json" });
      return res.end(JSON.stringify({ claims, userinfo }, null, 2));
    } catch (error) {
      return res.writeHead(400).end(String(error)); // error=access_denied and every refusal land here
    }
  }
  res.writeHead(404).end();
}).listen(PORT, () => console.log(`Open http://localhost:${PORT}/login`));

{
  "claims": {
    "iss": "https://accounts.teamofsilicons.com",
    "sub": "aQm",
    "aud": "briefcase",
    "exp": 1791343503,
    "iat": 1791341703,
    "auth_time": 1791341703,
    "nonce": "BrXP_yF6jiGsOrcQmOMyAjZVLpSITuhaZwekxsvD8WM",
    "name": "Oidc3 Docs",
    "picture": "https://iris.teamofsilicons.com/pfp/carbon?id=aQm",
    "preferred_username": "c:oidc3-docs",
    "email": "oidc3-docs@example.test",
    "email_verified": true
  },
  "userinfo": {
    "display_name": "Oidc3 Docs",
    "email": "oidc3-docs@example.test",
    "email_verified": true,
    "id": "c:oidc3-docs",
    "kind": "carbon",
    "membership_id": "briefcase:aQm",
    "name": "Oidc3 Docs",
    "pfp_url": "https://iris.teamofsilicons.com/pfp/carbon?id=aQm",
    "picture": "https://iris.teamofsilicons.com/pfp/carbon?id=aQm",
    "sub": "aQm",
    "updated_at": "2026-10-07T02:55:03.809Z",
    "uuid": "aQm",
    "version": 1
  }
}

{
  "authorization_endpoint": "https://accounts.teamofsilicons.com/authorize",
  "claims_parameter_supported": false,
  "claims_supported": ["iss", "sub", "aud", "exp", "iat", "auth_time", "nonce", "name", "picture", "preferred_username", "email", "email_verified", "phone_number", "phone_number_verified", "zoneinfo", "birthdate"],
  "code_challenge_methods_supported": ["S256", "plain"],
  "device_authorization_endpoint": "https://accounts.teamofsilicons.com/v1/device/authorize",
  "grant_types_supported": ["authorization_code", "refresh_token", "urn:ietf:params:oauth:grant-type:device_code", "urn:silicon:params:oauth:grant-type:slt"],
  "id_token_signing_alg_values_supported": ["EdDSA"],
  "introspection_endpoint": "https://accounts.teamofsilicons.com/v1/oauth/introspect",
  "introspection_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
  "issuer": "https://accounts.teamofsilicons.com",
  "jwks_uri": "https://accounts.teamofsilicons.com/.well-known/jwks.json",
  "prompt_values_supported": ["none", "login", "consent", "select_account"],
  "request_parameter_supported": false,
  "request_uri_parameter_supported": false,
  "response_modes_supported": ["query"],
  "response_types_supported": ["code"],
  "revocation_endpoint": "https://accounts.teamofsilicons.com/v1/oauth/revoke",
  "revocation_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
  "scopes_supported": ["profile", "email", "phone", "dob", "timezone", "openid", "offline_access"],
  "service_documentation": "https://developers.teamofsilicons.com/docs/accounts",
  "subject_types_supported": ["public"],
  "token_endpoint": "https://accounts.teamofsilicons.com/v1/oauth/token",
  "token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
  "userinfo_endpoint": "https://accounts.teamofsilicons.com/v1/userinfo"
}