+ *
+ * 
+
+# Scalekit Provider
+
+## Resources
+
+- [Add modular SSO with Scalekit](https://docs.scalekit.com/authenticate/sso/add-modular-sso/)
+- [Next.js + Auth.js example app](https://github.com/scalekit-developers/scalekit-authjs-example)
+- [Onboard enterprise customers](https://docs.scalekit.com/sso/guides/onboard-enterprise-customers/)
+- [SSO integrations guide](https://docs.scalekit.com/guides/integrations/sso-integrations/)
+
+## Setup
+
+### Callback URL
+
+
+
+
+```bash
+https://example.com/api/auth/callback/scalekit
+```
+
+
+
+
+```bash
+https://example.com/auth/callback/scalekit
+```
+
+
+
+
+```bash
+https://example.com/auth/callback/scalekit
+```
+
+
+
+
+```bash
+https://example.com/auth/callback/scalekit
+```
+
+
+
+
+### Environment Variables
+
+```
+AUTH_SCALEKIT_ID
+AUTH_SCALEKIT_SECRET
+AUTH_SCALEKIT_ISSUER
+```
+
+`AUTH_SCALEKIT_ISSUER` is your Scalekit environment URL (e.g. `https://yourenv.scalekit.dev`).
+
+### Configuration
+
+
+
+
+```ts filename="/auth.ts"
+import NextAuth from "next-auth"
+import Scalekit from "next-auth/providers/scalekit"
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+ providers: [Scalekit],
+})
+```
+
+
+
+
+```ts filename="/src/routes/plugin@auth.ts"
+import { QwikAuth$ } from "@auth/qwik"
+import Scalekit from "@auth/qwik/providers/scalekit"
+
+export const { onRequest, useSession, useSignIn, useSignOut } = QwikAuth$(
+ () => ({
+ providers: [Scalekit],
+ })
+)
+```
+
+
+
+
+```ts filename="/src/auth.ts"
+import { SvelteKitAuth } from "@auth/sveltekit"
+import Scalekit from "@auth/sveltekit/providers/scalekit"
+
+export const { handle, signIn, signOut } = SvelteKitAuth({
+ providers: [Scalekit],
+})
+```
+
+
+
+
+```ts filename="/src/app.ts"
+import { ExpressAuth } from "@auth/express"
+import Scalekit from "@auth/express/providers/scalekit"
+
+app.use("/auth/*", ExpressAuth({ providers: [Scalekit] }))
+```
+
+
+
+
+### SSO Routing
+
+Scalekit supports multiple ways to route users to their SSO connection. You can pass optional routing parameters to target a specific connection:
+
+
+
+
+```ts filename="/auth.ts"
+import NextAuth from "next-auth"
+import Scalekit from "next-auth/providers/scalekit"
+
+export const { handlers, auth, signIn, signOut } = NextAuth({
+ providers: [
+ Scalekit({
+ // pick one of the following routing strategies:
+ connectionId: "conn_...", // exact connection (highest precedence)
+ organizationId: "org_...", // org's active SSO connection
+ domain: "acme.com", // resolve org from email domain
+ }),
+ ],
+})
+```
+
+
+
+
+```ts filename="/src/routes/plugin@auth.ts"
+import { QwikAuth$ } from "@auth/qwik"
+import Scalekit from "@auth/qwik/providers/scalekit"
+
+export const { onRequest, useSession, useSignIn, useSignOut } = QwikAuth$(
+ () => ({
+ providers: [
+ Scalekit({
+ connectionId: "conn_...",
+ organizationId: "org_...",
+ domain: "acme.com",
+ }),
+ ],
+ })
+)
+```
+
+
+
+
+```ts filename="/src/auth.ts"
+import { SvelteKitAuth } from "@auth/sveltekit"
+import Scalekit from "@auth/sveltekit/providers/scalekit"
+
+export const { handle, signIn, signOut } = SvelteKitAuth({
+ providers: [
+ Scalekit({
+ connectionId: "conn_...",
+ organizationId: "org_...",
+ domain: "acme.com",
+ }),
+ ],
+})
+```
+
+
+
+
+```ts filename="/src/app.ts"
+import { ExpressAuth } from "@auth/express"
+import Scalekit from "@auth/express/providers/scalekit"
+
+app.use(
+ "/auth/*",
+ ExpressAuth({
+ providers: [
+ Scalekit({
+ connectionId: "conn_...",
+ organizationId: "org_...",
+ domain: "acme.com",
+ }),
+ ],
+ })
+)
+```
+
+
+
+
+
+ *
+ * ( + options: OAuthUserConfig
& { + /** + * Your Scalekit environment URL (e.g. `https://yourenv.scalekit.dev`). + * Used for OIDC discovery and as the token issuer. + */ + issuer: string + /** + * Route the user to a specific SSO connection by its ID (`conn_...`). + * Takes precedence over `organizationId` and `domain`. + */ + connectionId?: string + /** + * Route the user to a specific organization's active SSO connection (`org_...`). + */ + organizationId?: string + /** + * Route the user to the SSO connection associated with this email domain. + */ + domain?: string + } +): OIDCConfig
{ + const { issuer, connectionId, organizationId, domain } = options + + return { + id: "scalekit", + name: "Scalekit", + type: "oidc", + issuer, + authorization: { + params: { + scope: "openid email profile", + ...(connectionId && { connection_id: connectionId }), + ...(organizationId && { organization_id: organizationId }), + ...(domain && { domain }), + }, + }, + profile(profile) { + return { + id: profile.sub, + name: profile.name ?? `${profile.given_name} ${profile.family_name}`, + email: profile.email, + image: profile.picture ?? null, + } + }, + style: { bg: "#1c1c1e", text: "#fff" }, + options, + } +}