iwf
    Preparing search index...

    Class OAuthAuth

    OAuth 2.0 authentication provider using Authorization Code flow with PKCE.

    Designed for use in browser environments where a redirect-based OAuth flow is possible. Uses sessionStorage to temporarily hold PKCE state during the authorization redirect.

    The public interface (getCsrfToken, getAxiosInstance, getUserAgent) is compatible with BotPasswordAuth, so the two can be used interchangeably in upload options.

    const auth = new OAuthAuth({
          clientId: 'my-oauth-client-id',
          redirectUri: 'https://my-app.example.com/callback',
          userAgent: 'MyApp/1.0'
      });

      // Start the login flow (redirects the browser to Wikimedia)
      await auth.login();

      // After Wikimedia redirects back to redirectUri, handle the callback:
      await auth.handleCallback();

      // Now you can use the auth instance with upload()
      await upload(item, { auth, summary: 'OAuth upload' });
    Index

    Constructors

    constructor

    Accessors

    isAuthenticated

    Methods

    getAxiosInstance getCsrfToken getUserAgent getValidAccessToken handleCallback login logout

    Constructors

    • Creates a new OAuthAuth instance

      Parameters

      Returns OAuthAuth

      const auth = new OAuthAuth({
            clientId: 'my-client-id',
            redirectUri: 'https://my-app.example.com/auth/callback',
            userAgent: 'MyApp/1.0 (https://my-app.example.com)'
        });

    Accessors

    • get isAuthenticated(): boolean

      Returns whether the user currently has valid (non-expired) tokens stored.

      Returns boolean

      true if authenticated

      if (!auth.isAuthenticated) await auth.login();

    Methods

    • Returns an axios instance pre-configured with the OAuth Bearer token. Each request made through this instance will include an Authorization: Bearer header populated with a freshly-validated access token.

      Returns AxiosInstance

      Configured axios instance

      const ax = auth.getAxiosInstance();
        const response = await ax.get('https://www.wikidata.org/w/api.php?...');

    • Gets a CSRF token for the specified site using the OAuth Bearer token.

      For OAuth CORS requests the MediaWiki API requires both:

      • crossorigin= query parameter
      • Authorization: Bearer <token> header

      Parameters

      • site: string

        The site URL (e.g. https://www.wikidata.org)

      Returns Promise<string>

      The CSRF token

      If the OAuth session is no longer valid

      const csrfToken = await auth.getCsrfToken('https://www.wikidata.org');

    • Gets the user agent string

      Returns string

      The user agent

      const userAgent = auth.getUserAgent();

    • Returns a valid access token, refreshing it if it has expired.

      Returns Promise<string>

      The access token

      If no tokens are stored (user has not logged in)

      If the token has expired and cannot be refreshed

      const token = await auth.getValidAccessToken();

    • Handles the OAuth 2.0 callback after Wikimedia redirects back. Reads ?code and ?state from the current URL, validates state, exchanges the authorization code for tokens, and stores them.

      Must be called on the page matching redirectUri.

      Returns Promise<void>

      Resolves when tokens have been stored

      If the OAuth state is invalid, the code is missing, or the token exchange fails

      // On your callback page:
        await auth.handleCallback();
        window.location.href = '/';

    • Initiates the OAuth 2.0 Authorization Code + PKCE flow. Redirects the browser to the Wikimedia authorization endpoint.

      Must be called in a browser environment.

      Returns Promise<void>

      Resolves before the redirect (the page will navigate away)

      If called outside a browser environment

      await auth.login();
        // browser navigates to Wikimedia login page

    • Logs out by clearing all stored tokens and cache.

      Returns void

      auth.logout();

    Settings

    Member Visibility

    On This Page

    Constructors
    Accessors
    Methods