Interface: WithOcAuthOptions
Defined in: me-client/src/server.ts:425 (opens in a new tab)
ExtendsLink to this section
PropertiesLink to this section
| Property | Type | Description | Defined in |
|---|---|---|---|
audience? | AudienceRule | Accepted aud · see AudienceRule. An integrator verifying tokens from the sign-in popup sets this to its own origin, e.g. "https://example.com", so a token issued to another site is refused.Inherited from OcSessionOptions.audience · Overrides - | auth-core/src/index.ts:828 (opens in a new tab) |
issuer? | string | Auth host issuer. Defaults to https://ochk.io (opens in a new tab).Inherited from OcSessionOptions.issuer · Overrides - | auth-core/src/index.ts:818 (opens in a new tab) |
jwksCacheTtlMs? | number | JWKS cache TTL in ms. Defaults to 1 hour. Stale-on-error: if the cache exists, verification still works during a transient outage.Inherited from OcSessionOptions.jwksCacheTtlMs · Overrides - | auth-core/src/index.ts:821 (opens in a new tab) |
jwksMaxStaleMs? | number | How old a cached JWKS may be and still stand in during an outage. Defaults to 6 hours; past it, verification fails closed.Inherited from OcSessionOptions.jwksMaxStaleMs · Overrides - | auth-core/src/index.ts:824 (opens in a new tab) |
meOrigin? | string | Where me.ochk.io is: the project's sign-in rule and its list of ended sessions are read there. Default https://me.ochk.io (opens in a new tab) (OC_ME_ORIGIN for the list).Inherited from OcSessionOptions.meOrigin · Overrides - | me-client/src/server.ts:235 (opens in a new tab) |
method? | string | The request's method. While me.ochk.io's list of ended sessions can't be read, reads go on and writes are refused; with no method, a request counts as a write. The adapters pass it for you.Inherited from OcSessionOptions.method · Overrides - | me-client/src/server.ts:227 (opens in a new tab) |
projectKey? | string | Your project key. The requirement you set in the project's settings ("who can sign in") is read from me.ochk.io within a minute of a change and holds every signed-in account like requireBond, so you change it there, not in code. A request with no session is not held to it and never waits on reading it: pass required to answer it 401. An explicit requireBond wins over it. Default OC_PROJECT_KEY for the ended-session check only.Inherited from - · Overrides OcSessionOptions.projectKey | me-client/src/server.ts:448 (opens in a new tab) |
requireBond? | { maxAgeSecs?: number; minDays?: number; minSats?: number; } | Refuse a signed-in account (403, reason: 'bond_required') unless a bond backs it: one unspent coin of at least minSats, unspent at least minDays days, checked within maxAgeSecs. The app never learns the coin; req.ocSession.oc_bond.nullifier is the same for the same coin at your site, so ban that to ban the coin. Implies required.Inherited from - · Overrides - | me-client/src/server.ts:438 (opens in a new tab) |
requireBond.maxAgeSecs? | number | Inherited from - · Overrides - | me-client/src/server.ts:438 (opens in a new tab) |
requireBond.minDays? | number | Inherited from - · Overrides - | me-client/src/server.ts:438 (opens in a new tab) |
requireBond.minSats? | number | Inherited from - · Overrides - | me-client/src/server.ts:438 (opens in a new tab) |
required? | boolean | When true, unauthenticated requests get a 401 + {ok:false} response before the wrapped handler runs. Default: false — handler runs and receives req.ocSession === null, useful when the route serves both signed-in and anonymous users.Inherited from - · Overrides - | me-client/src/server.ts:430 (opens in a new tab) |
requireHandle? | boolean | Refuse a token bound to your site (one with aud) that carries no rh, its handle on your project's list of ended sessions. Without it "sign out everywhere" can't reach the session, so it is refused by default. Every token ochk.app's sign-in popup issues carries one; false accepts one minted some other way, and then sign out everywhere does not end it. A family session (no aud, on *.ochk.io) is not held to this: the family's own feed ends it. audience: '*' admits family sessions too, so keep it for routes that receive tokens forwarded from *.ochk.io. Default: true.Inherited from OcSessionOptions.requireHandle · Overrides - | me-client/src/server.ts:91 (opens in a new tab) |
revocation? | false | RevocationCheck | The check for sessions the person ended everywhere (sign out everywhere, a passkey removed, the account deleted). Default: auth-core's integratorRevocationCheck, from OC_PROJECT_KEY and OC_SIGNING_SECRET; none when they are unset. false turns it off.Inherited from OcSessionOptions.revocation · Overrides - | me-client/src/server.ts:242 (opens in a new tab) |