Skip to content
nanohypenanohype

OAuth Delegation Module

Composable outbound OAuth 2.0 delegation module. Handles the Authorization Code flow with PKCE, HMAC-signed state cookies, durable per-user token storage, and automatic refresh-before-expiry. Ships reference adapters for Notion, Google (Drive/Calendar/Analytics), Atlassian (Confluence), Slack, and HubSpot, plus in-memory and DynamoDB+KMS envelope-encrypted storage backends. Complements module-auth-ts — that verifies inbound requests, this delegates outbound calls on a user's behalf.

Namemodule-oauth-delegation-ts
Version0.1.0
Categorycomposable-modules
LicenseApache-2.0
Personaengineering
Tagsoauth, oauth2, pkce, delegation, integrations, typescript, security
Sourcetemplates/module-oauth-delegation-ts

Render it

Three front doors, one catalog. Pick whichever suits the caller.

# CLI
npx @nanohype/sdk render module-oauth-delegation-ts --out ./my-app

# SDK
import { LocalSource, renderTemplate } from "@nanohype/sdk";
const result = await renderTemplate(source, "module-oauth-delegation-ts", variables);

# MCP — from an agent
get_template({ name: "module-oauth-delegation-ts" })

Prerequisites

ToolVersionWhy
node>=22Node.js runtime for the OAuth delegation module
aws-cli (optional)—Provision the DynamoDB table and KMS key used by DDBKmsTokenStorage

Variables

Required

ProjectName string
Kebab-case project name, used as package name and directory Must be lowercase kebab-case starting with a letter.

Optional

Description string — defaults to Per-user OAuth 2.0 delegation with PKCE, token storage, and automatic refresh
Short project description for package.json and README

What it produces

46 files. Placeholder names such as __APP_NAME__ are what the renderer substitutes into.

.env.example
.gitignore
biome.json
package.json
README.md
src/oauth/__tests__/logger-redaction.test.ts
src/oauth/__tests__/pkce.test.ts
src/oauth/__tests__/providers/atlassian.test.ts
src/oauth/__tests__/providers/google.test.ts
src/oauth/__tests__/providers/hubspot.test.ts
src/oauth/__tests__/providers/notion.test.ts
src/oauth/__tests__/providers/slack.test.ts
src/oauth/__tests__/refresh.test.ts
src/oauth/__tests__/router.test.ts
src/oauth/__tests__/state.test.ts
src/oauth/__tests__/storage/ddb-kms.test.ts
src/oauth/__tests__/storage/memory.test.ts
src/oauth/errors.ts
src/oauth/handlers/callback.ts
src/oauth/handlers/errorMapping.ts
src/oauth/handlers/refresh.ts
src/oauth/handlers/revoke.ts
src/oauth/handlers/shared.ts
src/oauth/handlers/start.ts
src/oauth/index.ts
src/oauth/logger.ts
src/oauth/pkce.ts
src/oauth/providers/atlassian.ts
src/oauth/providers/google.ts
src/oauth/providers/hubspot.ts
src/oauth/providers/index.ts
src/oauth/providers/notion.ts
src/oauth/providers/registry.ts
src/oauth/providers/shared.ts
src/oauth/providers/slack.ts
src/oauth/providers/types.ts
src/oauth/refresh.ts
src/oauth/router.ts
src/oauth/state.ts
src/oauth/storage/ddb-kms.ts
src/oauth/storage/memory.ts
src/oauth/storage/types.ts
src/oauth/types.ts
tsconfig.build.json
tsconfig.json
vitest.config.ts

Composes with