Documentation

MultiAuthy is a thin OAuth gateway. You configure providers in the dashboard, receive a normalized user object in your app, and keep full control of your user model.

1. Create a project.
2. Configure at least one provider (paste Client ID and Secret).
3. Create an API key.
4. Install the SDK and drop in the two-line integration below.

npm install @multiauthy/sdk
# or: bun add @multiauthy/sdk

Every REST call is authenticated with a project-scoped API key. Send it as a bearer token:

Authorization: Bearer ma_live_...

import { MultiAuthy } from "@multiauthy/sdk"

const auth = new MultiAuthy({
  apiKey:    process.env.MULTIAUTHY_KEY,
  projectId: process.env.MULTIAUTHY_PROJECT,
})

app.get("/login", (_, res) => res.redirect(auth.login("google")))

app.get("/callback", auth.callback(), (req, res) => {
  console.log(req.user)  // normalized profile
  res.redirect("/")
})

GET /api/public/oauth/{projectId}/{provider}

Redirects the user to the provider's consent screen. Pass ?redirect_uri= with your app's callback.

GET /api/public/callback/{projectId}/{provider}

Provider redirects here. MultiAuthy exchanges the code, normalizes the profile, and redirects your app with a one-time ?ma_token=.

POST /api/public/session/exchange

Exchange the one-time token for the normalized user object. Requires your API key.

Google, GitHub, Discord, Microsoft, Apple, LinkedIn, Facebook, X (Twitter), GitLab, and Slack are all supported today. Add or remove them from the dashboard.

• invalid_project — project id not found
• provider_not_configured — add the provider first
• state_mismatch — CSRF check failed, retry
• token_expired — one-time token was already used

• Store API keys in a secrets manager, never in source control.
• Use a distinct key per environment (staging, production).
• Rotate keys on team changes.
• Verify req.user.verified before granting access to sensitive routes.