Wiki β†’ Authgarten

Authgarten is a central authentication system for Creatorsgarten projects.

Event organizers and other initiatives can use Authgarten to authenticate Creatorsgarten members. It implements the OpenID Connect protocol and aims to be easily integrated into applications, especially Next Auth.

  • Application Name β€” This is the application name that is displayed to the user when redirecting.
  • Client ID β€” This can be any URL. Recommended URL to GitHub repo that hosts the code.
  • Redirect URL(s) β€” Allowed URL to redirect.


Here’s an overview:

  1. Integrate with OpenID Connect using this issuer: See sections below to learn how to integrate.

  2. (Optional) If your app is a first-party app (built by Creatorsgarten team for use in an event), you can add app information to oauth.ts and submit a pull request to skip the data consent request.



Use express-openid-connect to protect your app. Just add the middleware and when user enters the app unauthenticated, they will be redirected to Authgarten.

import { auth as oidc } from 'express-openid-connect'

    issuerBaseURL: '',
    baseURL: 'http://localhost:3000',
    clientID: 'YOUR_CLIENT_ID',
    secret: 'LONG_RANDOM_STRING',

Manual integration

  1. Send user to with the following info:

  2. User will have to log in and give consent to share information.

    See example

  3. If the user provides consent, then they will be redirected to redirect_uri with the following query parameters:


    The id_token is a JSON Web Token.

    • You can decode it to get the user information.
    • You should verify the signature using the public key available at
    • You should check these claims in the payload:
      • iss β€” Should be
      • aud β€” Should be the client_id you specified
      • exp β€” Should be in the future

Here is an example code to decode the JWT.

import { createRemoteJWKSet, jwtVerify } from 'jose'

const issuer = ''
const keySetUrl = new URL('')
const clientId = 'example'
const keySet = createRemoteJWKSet(keySetUrl)
function validate(jwt) {
  return jwtVerify(jwt, keySet, { issuer, audience: clientId })

const result = await validate('eyJhb.....')

OAuth Scopes

Each OAuth scope will add more claims to the resulting JWT, allowing you to request more information as needed.

ScopeAffected ClaimDescription
emailemailInclude the email associated with the Eventpop account.<id>eventpopTicketsInclude the ticket information that the user has with the specified event ID. Only works with Creatorsgarten events.


EDIT 23 June 2023 / @dtinth