kv-oauth-state-store

Cloudflare KV-backed StateStore and SessionStore implementations for @atproto/oauth-client. Handles DPoP key serialization and automatic TTL management.

Installation

bash

npm install @atiproto/kv-oauth-state-store

Wrangler Configuration

Add two KV namespaces to your wrangler.jsonc: one for OAuth state (short-lived, used during login) and one for sessions (long-lived, used after login):

jsonc

{
  "kv_namespaces": [
    { "binding": "OAUTH_STATE_KV", "id": "<your-kv-id>" },
    { "binding": "OAUTH_SESSION_KV", "id": "<your-kv-id>" }
  ]
}

Quick Setup

typescript

import { KvStateStore, KvSessionStore } from "@atiproto/kv-oauth-state-store";
import { EdgeOAuthClient } from "@atiproto/edge-oauth-client";

interface Env {
  OAUTH_STATE_KV: KVNamespace;
  OAUTH_SESSION_KV: KVNamespace;
}

function createOAuthClient(env: Env) {
  return new EdgeOAuthClient({
    // ...
    stateStore: new KvStateStore(env.OAUTH_STATE_KV),
    sessionStore: new KvSessionStore(env.OAUTH_SESSION_KV),
  });
}

Classes

KvStateStore — Stores transient OAuth state between authorization request and callback (default TTL: 10 minutes)
KvSessionStore — Persists authenticated sessions for token refresh and restore (default TTL: 7 days)