SSO
Twitch
Add Twitch sign-in to VitNode using OpenID Connect. Register a Twitch application, add the redirect URL and wire up the Twitch SSO adapter.
Add a Continue with Twitch button. The adapter uses Twitch's OpenID Connect flow: it validates the ID token, then reads the email and avatar from Twitch's UserInfo endpoint.
Before you begin
- A running VitNode app. This page covers only the Twitch parts; SSO setup explains the shared steps and where the API's
.envand config live.
Set up the application
Register an application
Open the Twitch Developer Console (two-factor authentication must be on), press Register Your Application, pick a category that fits your site (such as Website Integration), and choose the Confidential client type.
Add the OAuth redirect URL
Add one entry per environment:
| Environment | OAuth Redirect URL |
|---|---|
Development (VITNODE_WEB_URL unset) | http://localhost:3000/login/sso/twitch |
| Production | https://your-domain.com/login/sso/twitch |
Twitch's own examples use http://localhost:3000; use localhost rather than 127.0.0.1. VitNode builds the URL from VITNODE_WEB_URL, so it must match exactly.
Copy the credentials
Open the application under Manage, copy the Client ID, press New Secret and copy the Client Secret:
TWITCH_CLIENT_ID=abcdefghijklmnopqrstuvwxyz0123
TWITCH_CLIENT_SECRET=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxAdd the adapter
Add TwitchSSOApiPlugin to authorization.ssoAdapters in the API's vitnode.api.config.ts (where it lives), next to any adapters you already have. Keep the rest of the config as it is:
import { TwitchSSOApiPlugin } from '@vitnode/core/api/adapters/sso/twitch'
import { buildApiConfig } from '@vitnode/core/vitnode.config'
export const vitNodeApiConfig = buildApiConfig({
// ...
authorization: {
ssoAdapters: [
// ...
TwitchSSOApiPlugin({
clientId: process.env.TWITCH_CLIENT_ID,
clientSecret: process.env.TWITCH_CLIENT_SECRET,
}),
],
},
})No authorization block yet? Create one with just ssoAdapters, as in the SSO setup. Then restart the dev server, since .env and the API config are only read at start-up.
Check the result
Open /login, press the Twitch button under Continue with and Authorize. You return to /login/sso/twitch signed in.
Scopes and profile fields
| Setting | Value |
|---|---|
| Scopes | openid user:read:email |
| Claims | email, email_verified, picture, preferred_username (requested with the claims parameter) |
| ID token | RS256 signature, issuer https://id.twitch.tv/oauth2, audience, expiry, nonce |
| Account ID | sub (the Twitch user ID) |
| Email trusted | only with email_verified: true |
| Profile fields | avatar |
user:read:email is required for the email claims. Twitch leaves the email out until the account has verified it; a new member then confirms an address by email, and a returning member signs in by their Twitch ID. Twitch has no first or last name.
Troubleshooting
- "redirect_mismatch". The OAuth Redirect URL differs from
{VITNODE_WEB_URL}/login/sso/twitch. - "invalid client secret". A New Secret replaces the old one; update
TWITCH_CLIENT_SECRET. - Asked to confirm an email. The Twitch account has no verified email yet.