Oslo Auth

Oslo (by the creator of Lucia) is a collection of lightweight auth building blocks rather than a complete framework — use it to compose custom auth flows with primitives like OAuth 2.0 client, PKCE, password hashing, session management, and HMAC. Good for teams that need specific auth utilities without adopting a full opinionated auth library. The primitives are well-tested and standards-compliant. Confidence is docs-derived.

npm install oslo. OAuth2: import {OAuth2Client} from "oslo/oauth2"; client.createAuthorizationURL(state, codeVerifier). Passwords: import {Argon2id} from "oslo/password"; await new Argon2id().hash(password). Sessions: import {generateSessionToken, encodeBase32LowerCaseNoPadding} from "oslo/crypto". HMAC: import {hmac} from "oslo/crypto". JWT: import {createJWT, validateJWT} from "oslo/jwt". Modular imports keep bundles small.

No Oslo API key — open-source library. Auth secrets (OAuth client ID/secret, JWT secret, HMAC key) managed by application. Open-source MIT license. Crypto operations run locally — no network auth calls. Standards-compliant implementations.

Cryptographic primitives are well-tested against standards. Edge-compatible: uses Web Crypto API where available. Password hashing (Argon2id) requires Node.js native bindings in Node.js environments. Token generation uses cryptographically secure randomness. Active GitHub (pilcrowonpaper/oslo). Maintained by same author as Lucia.

oslo.js.org covers each utility module with API reference and usage examples. Documentation is minimal-but-sufficient for building-block primitives. Getting started: npm install oslo, import specific modules as needed. Open-source MIT. Community via Oslo GitHub discussions.