fetch-mw-oauth2 is a JavaScript library designed to simplify OAuth2 integration with the standard `fetch` API, handling automatic token acquisition and refreshing. Currently at v3.3.1, it supports `authorization_code`, `password`, and `client_credentials` grant types, offers robust error handling, OpenID Connect `id_token` exposure, and includes support for token revocation (RFC 7009) and the `resource` parameter (RFC 8707). Since its v3.0.0 release, the library is ESM-only and has ceased support for Node.js 14 and 16. It primarily functions as a `fetch` wrapper or middleware. This package is in maintenance mode, as development has shifted to its successor, `@badgateway/oauth2-client`, which offers enhanced features and similar functionality.
Install & Compatibility
Where this runs
tested against v? · npm install
Install × environment matrix
Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux
muslnode 18–226 runs
build_error
glibcnode 18–226 runs
build_error
Code
Verified usage
Verified import paths — ran on the pinned version, not inferred.
Since v3.0.0, this library is ESM-only. CommonJS `require()` is not supported.
import { OAuth2 } from 'fetch-mw-oauth2'
TypeScript types are shipped with the package for improved development experience.
import type { OAuth2Options, OAuth2Token } from 'fetch-mw-oauth2'
The primary interaction is creating an OAuth2 instance and then using its `fetch` method, which transparently handles token management.
import { OAuth2 } from 'fetch-mw-oauth2';
const oauth2 = new OAuth2({
clientId: 'your-client-id',
clientSecret: process.env.OAUTH_CLIENT_SECRET ?? '', // Optional in some cases
tokenEndpoint: 'https://auth.example.org/token',
}, {
accessToken: 'initial-access-token',
refreshToken: 'initial-refresh-token',
});
const response = await oauth2.fetch('https://api.example.org/data');
This example demonstrates how to set up `fetch-mw-oauth2` using the client_credentials grant to automatically handle OAuth2 authentication and fetch a protected resource. It utilizes environment variables for sensitive data.
import { OAuth2 } from 'fetch-mw-oauth2';
async function authenticateAndFetch() {
// Configure OAuth2 for the client_credentials grant type
const oauth2 = new OAuth2({
grantType: 'client_credentials',
clientId: 'your-client-id',
clientSecret: process.env.OAUTH_CLIENT_SECRET ?? '', // Ensure this is loaded from environment variables
tokenEndpoint: 'https://auth.example.com/token',
scope: 'api:read api:write'
});
try {
// Use the wrapped fetch function which automatically handles Authorization headers and token refreshes
const response = await oauth2.fetch('https://api.example.com/protected-resource', {
method: 'GET',
headers: {
'Accept': 'application/json'
}
});
if (!response.ok) {
throw new Error(`HTTP error! status: ${response.status}`);
}
const data = await response.json();
console.log('Fetched data:', data);
} catch (error) {
console.error('Failed to fetch data with OAuth2:', error);
}
}
authenticateAndFetch();
Upgrade
Version history
Breaking-change detection hasn't run for this library yet.
Audit
Security & dependencies
CVE tracking and dependency tree are planned for a later release.