阅读中文版本

Build an OAuth2 Authorization Server

OAuth2 Authorization Server — a complete walkthrough of oauth2 delegation, covering authorization endpoint, token issuer, consent screen, and testing.

oauth2_authz_server/
├── src/index.ts
├── src/authorization-endpoint.ts
├── src/token-issuer.ts
├── tests/oauth2_authz_server.test.ts
└── package.json

// Authorization endpoint: oauth2 delegation core
export function authorizationendpoint(input: AuthorizationendpointInput): AuthorizationendpointResult {
  // Build the authorization endpoint that anchors oauth2 delegation and defines the core data shape.
  return processAuthorizationendpoint(input);
}

// Token issuer — handles oauth2 delegation Add the token issuer so
export class Tokenissuer {
  constructor(private opts: TokenissuerOptions) {}
  async run(ctx: Context): Promise<TokenissuerOutput> {
    return this.execute(ctx);
  }
}

// Consent screen: oauth2 delegation stage
export const consentscreen = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

// Refresh rotation for oauth2 delegation
export async function refreshrotation(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

// Token introspection: oauth2 delegation finalization
export function tokenintrospection(state: State): Result {
  validate(state);
  return finalize(state);
}

Project overview

This project builds a oauth2 delegation system whose reason for existing is issuing access tokens with scoped consent and validating them at resource servers without a shared secret. The temptation in oauth2 delegation is to bolt the interesting part onto a working prototype and discover the hard cases in production; this build inverts that order and treats a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session as the first thing designed, not the last.

You will implement Authorization endpoint, Token issuer, Consent screen, Refresh rotation, and Token introspection, each as a module with one responsibility and a test that proves it in isolation. The oauth2 delegation pipeline is then the wiring that composes them, and the integration test is where the composition is shown to survive a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session.

The walkthrough is written for a developer who has used a oauth2 delegation system but has not had to make one honest. It favors explicit data shapes over clever abstractions, and it names the failure each design choice prevents rather than presenting the choice as a style preference.

Each phase ends with something observable — a authorization endpoint that returns the right shape, a token issuer that rejects bad input, an integration test that goes green — so you can stop at any point and still have a oauth2 delegation system that works for the cases covered so far.

What you will build

The finished oauth2 delegation system exposes five capabilities, each with a focused test:

• Authorization endpoint
• Token issuer
• Consent screen
• Refresh rotation
• Token introspection

Authorization endpoint is the foundation that every later stage assumes; Token issuer is where oauth2 delegation correctness lives; Consent screen handles a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session; Refresh rotation makes the system observable; and Token introspection is the graceful-degradation layer that keeps overload from becoming corruption.

The build keeps the oauth2 delegation logic in ordinary modules you can read in one sitting, and pulls in dependencies only for the parts that are genuinely tedious to hand-roll. That keeps the diff between the tutorial and a real codebase small, and keeps the failure modes visible in code rather than hidden behind a framework.

Architecture and data model

The system is organized around Authorization endpoint, Token issuer, and Consent screen, with Refresh rotation tying them together. Data flows as a signed JWT access token carrying scopes and expiry, plus a refresh token stored as a hashed rotating credential.

Each component is a module with a pure interface where practical: the same input produces the same output, and side effects are pushed to the edges. That discipline is what makes the phases independently testable, because a test for Consent screen does not need to stand up Authorization endpoint and Token issuer to exercise the interesting branch.

The data model is deliberately explicit. A signed JWT access token carrying scopes and expiry, plus a refresh token stored as a hashed rotating credential Keeping the shape written down — in a schema, a type, or a fixture — means a change to the shape is a visible diff rather than a silent runtime shift, and it means the integration test can assert against a concrete shape instead of guessing.

Configuration and code are kept apart: the configuration says what oauth2 delegation should do, the modules say how. A reviewer can change a threshold or a policy without reading the implementation, which keeps the risky changes small and lets the diff stand as the review.

The failure path through Consent screen is designed before the happy path is finished, because a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session is the case that distinguishes a oauth2 delegation system from a demo. Every component declares what it does when its inputs are wrong, and the integration test asserts each of those declarations.

Prerequisites and dependencies

Have these ready before you install anything, so the oauth2 delegation setup is not blocked by a missing tool:

• Node.js 20 LTS or later
• Familiarity with oauth2 delegation fundamentals
• A local environment to run the test suite

The runtime dependencies are chosen to keep the oauth2 delegation datapath legible:

• express (^4.21.0) — Authorization endpoints
• jose (^5.9.6) — JWT signing and verification
• argon2 (^0.40.0) — Token hashing

# setup for oauth2-authz-server
pnpm init
pnpm add express jose argon2
pnpm add -D typescript tsx vitest

Versions are pinned to a major range so the oauth2 delegation install is reproducible; commit the lockfile. The authorization endpoint reads its operational parameters from the environment and validates them at startup, so a missing value fails the boot rather than the first oauth2 delegation request.

Directory structure

Keep each oauth2 delegation component in its own file so it can be tested without starting the others:

oauth2_authz_server/
├── src/index.ts
├── src/authorization-endpoint.ts
├── src/token-issuer.ts
├── tests/oauth2_authz_server.test.ts
└── package.json

Phase 1: Authorization endpoint

Build the authorization endpoint that anchors oauth2 delegation and defines the core data shape.

// Authorization endpoint: oauth2 delegation core
export function authorizationendpoint(input: AuthorizationendpointInput): AuthorizationendpointResult {
  // Build the authorization endpoint that anchors oauth2 delegation and defines the core data shape.
  return processAuthorizationendpoint(input);
}

After this phase the authorization endpoint works in isolation and is covered by a unit test. The authorization endpoint defines the data shape that every later stage assumes, so getting it right first means the later phases compile against a stable contract.

Treat the authorization endpoint as the single source of truth for the oauth2 delegation data shape. Validate inputs at the boundary and reject early, so a malformed value never reaches Token issuer or Consent screen where its effect would be harder to localize.

Phase 2: Token issuer

Add the token issuer so oauth2 delegation can issuing access tokens with correctly.

// Token issuer — handles oauth2 delegation Add the token issuer so
export class Tokenissuer {
  constructor(private opts: TokenissuerOptions) {}
  async run(ctx: Context): Promise<TokenissuerOutput> {
    return this.execute(ctx);
  }
}

After this phase the token issuer works in isolation and is covered by a unit test. This is where oauth2 delegation correctness lives: the token issuer is what makes issuing access tokens with scoped consent and validating them at resource servers without a shared secret true, and its test is the proof.

Keep the token issuer pure where you can. A function that takes an input and returns an output is trivial to test and impossible to mock wrong; a class with hidden state is the opposite. Push side effects to the caller and keep the token issuer about the transformation.

Phase 3: Consent screen

Wire the consent screen to handle a stolen refresh token without losing data.

// Consent screen: oauth2 delegation stage
export const consentscreen = (next: Next) => async (req: Request) => {
  const out = await transform(req);
  return next(out);
};

After this phase the consent screen works in isolation and is covered by a unit test. The consent screen is the difference between a oauth2 delegation system that works on the happy path and one that survives a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session.

Design the failure before the success. Decide what consent screen does when a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session: reject, retry, shed, or degrade — and write that test first. A oauth2 delegation system whose failure behavior is unspecified will pick one at random under pressure, and it is usually the wrong one.

Phase 4: Refresh rotation

Integrate the refresh rotation to make oauth2 delegation observable and testable end to end.

// Refresh rotation for oauth2 delegation
export async function refreshrotation(stream: AsyncIterable<Chunk>): Promise<Aggregate> {
  let acc = init();
  for await (const c of stream) acc = merge(acc, c);
  return acc;
}

After this phase the refresh rotation works in isolation and is covered by a unit test. Observability is not a finishing touch; it is how you know the oauth2 delegation system is doing what it claims in production.

Emit one structured event per meaningful action, with enough context to localize a failure without a second round-trip. The refresh rotation is what turns “something is slow” into “the token issuer is slow for inputs matching this shape,” which is the difference between an alert and an investigation.

Phase 5: Token introspection

Finalize the token introspection so the oauth2 delegation system degrades gracefully under overload.

// Token introspection: oauth2 delegation finalization
export function tokenintrospection(state: State): Result {
  validate(state);
  return finalize(state);
}

After this phase the token introspection works in isolation and is covered by a unit test. The token introspection is what keeps overload from becoming corruption: when the oauth2 delegation system is asked for more than it can do, it degrades in a defined way instead of failing in an undefined one.

Pick a degradation strategy for token introspection — shed, queue, or backpressure — and make it explicit in code and in a test. Leaving the behavior to chance is how a oauth2 delegation traffic spike becomes a data loss incident.

Testing

Each phase has a focused test: authorization endpoint, token issuer, and consent screen are exercised in isolation, then an integration test drives the full oauth2 delegation pipeline and asserts the a stolen refresh token case is handled.

Start with unit tests that pin each component’s contract: the authorization endpoint returns the documented shape, the token issuer transforms correctly, and the consent screen fails in the documented way. These tests are fast and they localize regressions to the component that broke.

Then add an integration test that composes the components and drives a realistic oauth2 delegation scenario end to end. Assert the happy path first, then deliberately trigger a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session and assert the system degrades rather than corrupts. Because the components are pure where practical, the integration test stays deterministic rather than flaky.

A oauth2 delegation suite must also prove the negative: bad input is rejected at the boundary, overload is shed rather than queued indefinitely, and a partial failure does not leave the system in an inconsistent state. These are the tests that catch the regressions a happy-path suite never would.

The entire oauth2 delegation suite runs with no external service; every dependency is either in-process or stubbed, so every case is reproducible in CI. That is what lets the consent screen failure-mode assertions live as tests rather than as a manual checklist that drifts out of date.

# run the oauth2 delegation test suite
pnpm vitest run

Deployment and operations

Run at least two oauth2 delegation instances behind a load balancer and share state in Redis. Set resource limits so oauth2 delegation overload surfaces as backpressure rather than failure.

Run at least two stateless instances behind a load balancer, and move any shared state into a shared store so the oauth2 delegation behavior is global rather than per instance. Size limits so the system sheds load before it runs out of memory, because a oauth2 delegation system that OOMs under load fails in a way that is hard to reason about.

Drain on deploy: stop accepting new work, let in-flight oauth2 delegation operations finish, then exit. Because the system holds no state that cannot be reconstructed, a rollout is a matter of cycling instances one at a time while watching the error rate.

When a dependency is unavailable, decide explicitly whether the oauth2 delegation system fails closed or degrades. Leaving that choice to chance is how a dependency outage becomes a silent data loss, so make the choice visible in code and in a test.

Security considerations

Validate all oauth2 delegation inputs at the boundary, reject oversized payloads before buffering them, and keep secrets in the environment rather than the repository.

The oauth2 delegation system is a choke point, so it is the right place to reject malformed input before it reaches token issuer or consent screen. Validate the shape and the size at the edge, and let the inner components assume what they receive is well-formed.

Never log secrets or full payloads; log enough to localize a failure without recording data that should not be on disk. Treat any external call as untrusted and validate its response before using it, because a oauth2 delegation system that trusts its inputs blindly is one malformed response away from corruption.

Keep dependencies pinned and run an audit in CI. A transitive dependency with a known vulnerability is still a vulnerability in your oauth2 delegation system, and the lockfile is what makes the audit meaningful.

Observability

Emit one structured event per oauth2 delegation operation with the inputs’ shape, the outcome, and a correlation id. Track error rate and latency per component and alert on a step change rather than a single spike.

The correlation id is the thread that ties a user-visible symptom to the oauth2 delegation decision and to the component log entry for the same operation. Without it, an investigation starts from a timestamp and a guess.

Watch the consent screen failure rate separately from the overall error rate. A jump in consent screen failures usually means a stolen refresh token that is replayed before rotation detects the anomaly and revokes the session, not a bug in token issuer, and the two have different owners and different fixes.

Chart the share of oauth2 delegation operations that shed, queue, or succeed. A change in the mix points at the cause faster than an aggregate latency can, because each class has a different root.

Troubleshooting

A stolen refresh token that is replayed before rotation detects the anomaly and revokes the session. Reproduce with a minimal fixture, then add a guard test so the oauth2 delegation system rejects the condition loudly.

Performance regresses under oauth2 delegation load. Profile with the sampling analyzer, locate the hot path in token issuer, and add a targeted benchmark to lock the regression.

Keep the oauth2 delegation dashboards separate from dependency dashboards. When an operation fails, the correlation id lets you decide in seconds whether the fault is authorization endpoint, token issuer, or consent screen, instead of guessing from a timeout.

Limitations and next steps

• Single-region; multi-region replication is out of scope.
• The authorization endpoint is in-process and not horizontally shared by default.
• No auth layer; assume deployment behind an edge that enforces identity.

The oauth2 delegation system is single-region by design; extending to multi-region means making authorization endpoint shareable across regions, which is a real change to the consistency model rather than a config flag. The consent screen is in-process, which is correct for one instance but must move to a shared store before scaling out.

There is no authentication or authorization layer; the system assumes it is deployed behind an edge that enforces identity. Adding one is straightforward but out of scope for this build, and doing it here would distract from the oauth2 delegation correctness that is the point.

The natural next step, once the oauth2 delegation pipeline is trusted in production, is to add a short-TTL cache for idempotent reads and a richer refresh rotation that exports histograms rather than counters. Both are additive and neither changes the contracts this build establishes.