Class: TokenManager

TokenManager(client, optsopt)

Caches TokenSets per key (typically a user session id) and keeps them fresh.

  • getAccessToken(key) always returns a token valid for at least refreshSkewSec, refreshing on demand.
  • With autoRefresh (default), a timer refreshes each token refreshSkewSec before it expires.
  • Concurrent refreshes for the same key are coalesced into one token-endpoint call; across tabs sharing a store, a refresh holds a Web Lock and reuses the tokens another tab has just obtained, so a rotating refresh token is never presented twice.
  • set(key, ts, { schedule: false }) / unschedule(key) keep a key's tokens without refreshing them.

Events: "refreshed" (key, tokenSet) — new tokens obtained via refresh_token "refresh_error" (key, error) — refresh failed (tokens are dropped if the grant is invalid) "expired" (key) — tokens for key could not be renewed and were removed "removed" (key) — tokens deleted via delete()

Constructor

new TokenManager(client, optsopt)

Parameters:
Name Type Attributes Description
client *

(TypeScript: import('./oidc-client.js').OIDCClient)
opts Object <optional>

(TypeScript: { store?: import('./stores.js').TokenStore, refreshSkewSec?: number, autoRefresh?: boolean, minRefreshDelayMs?: number, retryDelayMs?: number })
Source:

Classes

TokenManager

Methods

close()

Cancels all refresh timers (call on shutdown).

Source:

(async) delete(key, optsopt)

Removes tokens for key, optionally revoking them at the OP (RFC 7009).

Parameters:
Name Type Attributes Description
key string
opts Object <optional>

(TypeScript: { revoke?: boolean })
Source:

(async) get(key) → {Promise.<(TokenSet|undefined)>}

Parameters:
Name Type Description
key string
Source:
Returns:

Cached tokens (possibly expired) for key.

Type
Promise.<(TokenSet|undefined)>

(async) getAccessToken(key, optsopt) → {Promise.<string>}

Returns a usable access token for key, refreshing first if it is expired or about to expire.

Parameters:
Name Type Attributes Description
key string
opts Object <optional>

(TypeScript: { forceRefresh?: boolean })
Source:
Returns:
Type
Promise.<string>

(async) getTokenSet(key, optsopt) → {Promise.<TokenSet>}

Returns the cached TokenSet for key, refreshing first if the access token is (nearly) expired. Use this rather than getAccessToken() when the token may be DPoP-bound: the caller needs its token_type to build the right Authorization header (OIDCClient.resourceHeaders()).

Parameters:
Name Type Attributes Description
key string
opts Object <optional>

(TypeScript: { forceRefresh?: boolean })
Source:
Returns:
Type
Promise.<TokenSet>

refresh(key) → {Promise.<TokenSet>}

Refreshes tokens for key now. Concurrent calls share a single request.

Parameters:
Name Type Description
key string
Source:
Returns:
Type
Promise.<TokenSet>

(async) schedule(key) → {Promise.<void>}

Schedules the proactive refresh of the tokens already stored for key.

Parameters:
Name Type Description
key string
Source:
Returns:
Type
Promise.<void>

(async) set(key, tokenSet, optsopt)

Stores tokens for a key and (unless schedule: false) schedules their proactive refresh.

Parameters:
Name Type Attributes Description
key string
tokenSet TokenSet | object
opts Object <optional>

(TypeScript: { schedule?: boolean })
Source:

unschedule(key)

Stops refreshing key's tokens in the background; they stay stored.

Parameters:
Name Type Description
key string
Source: