passport-approveapi

ApproveAPI passwordless authentication strategy for PassportJS

Installation

npm install passport-approveapi

Usage

Configure Strategy

The ApproveAPIStrategy constructor receives three parameters:

options: A javascript object containing some configuration:
- apiKey An ApproveAPI api key.
- callbackUrl: A URL which users will be redirected to once they approve the login prompt. Must be set as an endpoint for acceptToken.
- contactField: The name of the field which contains the email or other contact handle of the user to send the prompt to.
- promptMessage: The message included with the login prompt.
- ttl: Optional integer, defaults to 10 minutes (in seconds). It's used to set the token and prompt expiration.
- secret: An encryption secret used to sign the login tokens.
verifyUser: A function that receives the request and returns a promise containing the user object. It may be used to insert and/or find the user in the database.

Authenticate Requests

Use passport.authenticate(), specifying the 'approveapi' strategy for two actions:

requestToken

In this situation the passport authenticate middleware will send a token produced by the user information, which is returned by the verifyUser function.

app.post('/auth/approveapi',
    passport.authenticate('approveapi', { action : 'requestToken' }),
    (req, res) => res.redirect('/check-your-inbox')
)

acceptToken

In this situation the passport authenticate middleware will check for a valid token.

app.get('/auth/approveapi/callback',
  passport.authenticate('approveapi', { action : 'acceptToken' }),
  (req, res) => res.redirect('/profile')
)