Quickstart

This walks through a full login. A user approves your app, your app receives a token, and your app reads the profile of the user who approved access.

Prerequisites

Create a Web application in the console and add a redirect URI, for example https://your.app/callback. See Register an application.

Grant the profile scope

Add the profile:read scope so your app can read the user’s account.

Install the SDK

npm install @nemu-ai/sdk

bun add @nemu-ai/sdk

Build an authorize URL and redirect the user to it. The SDK generates the PKCE values for you. Keep code_verifier and state for the callback.

import { NemuOAuth } from "@nemu-ai/sdk";

const oauth = new NemuOAuth({
  client_id: process.env.nemu_client_id!,
  client_secret: process.env.nemu_client_secret!,
  redirect_uri: "https://your.app/callback",
});

const { url, code_verifier, state } = oauth.authorize_url({
  scopes: ["profile:read", "workspaces:read"],
  state: "a_random_value",
});

save_to_session({ code_verifier, state });
redirect(url);

The user lands on the consent screen, sees the scopes you asked for, and approves. We then redirect back to your redirect_uri with a short lived code and the state you sent.

Handle the callback

Verify the state, then exchange the code for tokens. exchange_code returns a ready to use client that acts as the user.

callback.ts

import { NemuOAuth } from "@nemu-ai/sdk";

const oauth = new NemuOAuth({
  client_id: process.env.nemu_client_id!,
  client_secret: process.env.nemu_client_secret!,
  redirect_uri: "https://your.app/callback",
});

const { code_verifier, state } = load_from_session();
if (query.state !== state) throw new Error("state_mismatch");

const nemu = await oauth.exchange_code({
  code: query.code,
  code_verifier,
});

const user = await nemu.user.get();
console.log(user.email, user.id, user.plan);

nemu.user.get() returns the user who approved access. This is the answer to “who clicked Authorize”.

Keep the session

exchange_code accepts an on_refresh callback so you can persist rotated tokens. Restore a client later with from_tokens.

const nemu = await oauth.exchange_code({
  code: query.code,
  code_verifier,
  on_refresh: (tokens) => save_tokens(user_id, tokens),
});

const restored = oauth.from_tokens(load_tokens(user_id), (tokens) =>
  save_tokens(user_id, tokens),
);

OAuth 2.0

Prerequisites

Handle the callback

Keep the session

Next steps

Authorization code

Scopes

​Prerequisites

​Send the user to the consent page

​Handle the callback

​Keep the session

​Next steps

Authorization code

Scopes

Prerequisites

Send the user to the consent page

Handle the callback

Keep the session

Next steps