Arctic

Arctic was deprecated in July 2026 (announcement). Some example code with comments to replace the package can be found under /code directory in the repository (see below). The old documentation and API reference can be found in the GitHub repository.

For a basic OAuth 2.0 flow, the user is first redirected to the authorization server (e.g. google.com) to sign in. This is called the authorization request. Next, the user is redirected back to your server with an authorization code in the URL query string. Your server exchanges that authorization code for a new access token by sending an access token request to the authorization server. The authorization server may also return a refresh token, which can be exchanged for a new access token in the future by sending another access token request.

Before starting, you should do the following:

• Register an OAuth client with the provider. You should note down the client ID and the client secret if issued.
• Find the authorization server's authorization URL and token endpoint.
• Check if the authorization server supports PKCE. If it isn't specified, it likely doesn't support PKCE. Using PKCE is recommended if supported.

Example code:

• Authorization request without PKCE: authorization_request.ts
• Authorization request with PKCE: authorization_request-pkce.ts
• Authorization code exchange without PKCE: authorization_code_exchange.ts
• Authorization code exchange with PKCE: authorization_code_exchange-pkce.ts
• Refresh request: refresh_request.ts
• Token revocation request: token_revocation_request.ts

For a deep dive on everything auth, see the Auth Book. Feel free to ask questions on the Discord server linked in the book.

This website is maintained by Pilcrow. The source code is hosted at github.com/pilcrowonpaper/arctic.