Authorization

Authorization helpers for protected resources

Use auth helpers for authorization code exchange, token validation, and related login token flows on the Scalekit client.

These methods sit next to session management—use them when implementing hosted login callbacks and token checks.

getLoginRequestDetails

clientAuthhttps://github.com/scalekit-inc/scalekit-sdk-node/blob/main/src/auth.ts

#asyncgetLoginRequestDetails

Resolves a login request ID into the authorization request it was issued for, the OAuth client that started it, and the resource being accessed. Call it when your login page needs to know which client is asking and which scopes were requested.

Available in @scalekit-sdk/node 2.17.0 and later.

paramloginRequestIdstring

The login request identifier from the authorize redirect, in lri_ format. It expires 15 minutes after the authorization request is handed off.

returnsGetLoginRequestDetailsResponse

The authorization request and its requested scopes, the client that started it, and the resource it targets. resource is absent when the authorization request is not scoped to a resource, and also when Scalekit cannot resolve the resource — the call succeeds either way. Treat an absent resource as nothing to display, not as proof the request was unscoped.

const details = await scalekit.auth.getLoginRequestDetails('lri_73415099636808061');

// Which client is asking, and what it requested
console.log(details.client?.clientName);
console.log(details.client?.clientId); // CIMD metadata URL for a CIMD client, otherwise m2m_xxx
console.log(details.client?.skClientId); // always m2m_xxx, for every client
console.log(details.authRequest?.scopes);

For a client registered through a Client ID Metadata Document (CIMD), clientId is the HTTPS URL of that document while skClientId is the identifier Scalekit issued, in m2m_xxx format. For every other client both are m2m_xxx. Use skClientId to correlate the client across Scalekit APIs and the dashboard.

An unknown login request ID, an expired one, and one belonging to another environment all fail the same way, so the error cannot tell you which of the three it was.

updateLoginUserDetails

clientAuthhttps://github.com/scalekit-inc/scalekit-sdk-node/blob/main/src/auth.ts

#asyncupdateLoginUserDetails

Updates user details for an ongoing authentication request.

paramconnectionIdstring

The SSO connection ID being used for authentication

paramloginRequestIdstring

The unique login request identifier from the auth flow

paramuserUserInput

User profile fields.

returnsUpdateLoginUserDetailsResponse

Response containing the auth request ID (response.authRequestId), which you can use to look up the user’s authentication journey in the auth logs.

const response = await scalekit.auth.updateLoginUserDetails(
  'conn_abc123',
  'lri_73415099636808061',
  {
    email: 'john.doe@company.com',
    sub: 'unique_user_id_456',
  }
);

// The auth request ID can be used to look up the authentication journey via auth logs.
console.log(response.authRequestId);