Tauri Plugin Auth Session API

0.2.2 · active · verified Wed Apr 22

This package provides the TypeScript API for `tauri-plugin-auth-session`, a Tauri v2 plugin designed for secure in-app OAuth authentication across mobile and desktop platforms. It leverages native browser authentication sessions: `ASWebAuthenticationSession` on macOS and iOS, and Chrome Custom Tabs on Android. The plugin enables a seamless, secure authorization flow by capturing OAuth redirects to custom URL schemes directly within the app, bypassing the need for external browser launches or localhost web server listeners. It's crucial for Tauri v2 mobile development, where traditional desktop OAuth patterns are impractical. The current stable version is 0.2.2, indicating active development within the v0 series, with new features and stability improvements likely tied to the progression of Tauri v2 itself. Key differentiators include a single `start()` API call, native browser security (credentials never touch WebView), SSO support, and full compatibility with PKCE/OAuth 2.0/OIDC providers.

Common errors

Warnings

Install

Imports

Quickstart

Demonstrates how to initiate an OAuth 2.0 PKCE authorization flow using the `start` function, targeting a Google provider. It shows the construction of the authorization URL, handling the intercepted redirect callback, and extracting the authorization code and state.

import { start } from 'tauri-plugin-auth-session-api';

/**
 * Initiates an OAuth 2.0 PKCE authentication flow with Google.
 * Replace placeholders with your actual OAuth provider details.
 * 
 * NOTE: This client-side code assumes a backend will handle the code exchange for tokens.
 * For a purely public client, you'd exchange the code directly.
 */
async function authenticateWithGoogle(): Promise<void> {
  const clientId = 'YOUR_GOOGLE_CLIENT_ID'; // Replace with your actual client ID
  const redirectUri = 'myapp://oauth-callback'; // Must match your native app setup (AndroidManifest, Associated Domains)
  const scope = 'openid profile email';

  // In a real application, you would securely generate code_verifier and code_challenge
  // For simplicity, placeholders are used here.
  const codeVerifier = 'YOUR_GENERATED_CODE_VERIFIER';
  const codeChallenge = 'YOUR_GENERATED_CODE_CHALLENGE_S256';

  const authorizeUrl = `https://accounts.google.com/o/oauth2/v2/auth?` +
                       `client_id=${clientId}&` +
                       `redirect_uri=${encodeURIComponent(redirectUri)}&` +
                       `response_type=code&` +
                       `scope=${encodeURIComponent(scope)}&` +
                       `state=secure_random_state_string&` + // Always generate a cryptographically secure state
                       `code_challenge=${codeChallenge}&` +
                       `code_challenge_method=S256`;

  try {
    console.log('Starting OAuth flow...');
    const callbackUrl = await start({
      authorizeUrl,
      redirectUri: redirectUri, // The scheme and host your app will intercept
      ephemeral: false // Set to true on Apple platforms for non-SSO sessions
    });

    console.log('OAuth callback URL received:', callbackUrl);
    const url = new URL(callbackUrl);
    const code = url.searchParams.get('code');
    const state = url.searchParams.get('state');

    if (code && state) {
      console.log('Authorization Code:', code);
      console.log('State:', state);
      // Now, exchange the 'code' for access/refresh tokens.
      // This is typically done on a backend server to keep client secret secure.
    } else {
      console.error('Authorization code or state not found in callback URL.');
    }
  } catch (error) {
    console.error('OAuth flow failed:', error);
    if (error instanceof Error && error.message.includes("unsupported platform")) {
      console.warn("Authentication is not supported on this platform (Windows/Linux).");
    }
  }
}

// Example usage (e.g., triggered by a button click)
// authenticateWithGoogle();

view raw JSON →