Downloads & examples

Reference bundle 0.5.0 · Node.js 22 or newer · no Oathvera repository access required.

Download the Node.js reference bundle

Run your first login

Unzip the download, open the oathvera-examples directory in a terminal, and run:

npm ci --ignore-scripts
cp .env.example .env

Edit .env with your Sandbox issuer, confidential client ID and one-time server secret. Register http://localhost:3000/callback, then run:

npm run web

Open http://localhost:3000/login. Follow the full first-login walkthrough for configuration, account creation, callback verification and logout.

Included files

File	Purpose
server-web.mjs	Local confidential-client login, callback validation and logout.
machine-to-machine.mjs	Token issuance, one permission check and revocation for a service client.
config.mjs, .env.example	Server-only configuration and placeholders.
permission-check.mjs	Bounded API permission checks with explicit denial handling.
account-center.mjs	Hosted Account Security launch and callback adapter.
package.json, package-lock.json	Reproducible dependency setup.
*.test.mjs	Offline helper regression checks.

The examples contain no customer credentials. Never commit your populated .env. Use your deployment platform’s secret store in a real backend.

Standalone helpers

• Account Security server adapter and setup guide.
• API permission-check helper and authorization guide.
• First-login guide as Markdown.
• Account Security guide as Markdown.

What the bundle does not provide

The login example keeps transactions and sessions in process memory. It does not implement shared persistence, rotating refresh, ongoing online session validation or your product’s account mapping. Do not deploy it as production authentication middleware.

The Account Security helper requires your existing session validation, CSRF protection, real server-held user access token and durable atomic pending store. Downloading it does not enable the feature in your environment.

For production, use application integration, sessions and credentials and the production checklist.

Machine-to-machine example

Create a separate M2M client and grant it an API resource and permission. Set that client’s credentials, OATHVERA_RESOURCE, and OATHVERA_SCOPE in a separate local configuration before running npm run m2m. It makes real requests to the selected environment and revokes its issued token on success. See service integration.

Verify the download

The release manifest records the SHA-256 hash of each download. To compare the bundle:

shasum -a 256 oathvera-examples-0.5.0.zip

The manifest helps detect a mismatched download; it is not a separate signed attestation. See documentation releases for changes.