Auth0 Express Integration

Add authentication to Express.js web applications using express-openid-connect.

Prerequisites

When NOT to Use

Quick Start Workflow

1. Install SDK

npm install express-openid-connect dotenv

2. Configure Environment

For automated setup with Auth0 CLI, see Setup Guide for complete scripts.

For manual setup:

Create .env:

SECRET=
BASE_URL=http://localhost:3000
CLIENT_ID=your-client-id
CLIENT_SECRET=your-client-secret
ISSUER_BASE_URL=https://your-tenant.auth0.com

Generate secret: openssl rand -hex 32

3. Configure Auth Middleware

Update your Express app (app.js or index.js):

require('dotenv').config();
const express = require('express');
const { auth, requiresAuth } = require('express-openid-connect');
const app = express();
// Configure Auth0 middleware
app.use(auth({
  authRequired: false,  // Don't require auth for all routes
  auth0Logout: true,    // Enable logout endpoint
  secret: process.env.SECRET,
  baseURL: process.env.BASE_URL,
  clientID: process.env.CLIENT_ID,
  issuerBaseURL: process.env.ISSUER_BASE_URL,
  clientSecret: process.env.CLIENT_SECRET
}));
app.listen(3000, () => {
  console.log('Server running on http://localhost:3000');
});

This automatically creates:

4. Add Routes

// Public route
app.get('/', (req, res) => {
  res.send(req.oidc.isAuthenticated() ? 'Logged in' : 'Logged out');
});
// Protected route
app.get('/profile', requiresAuth(), (req, res) => {
  res.send(
    
Profile

    
Name: ${req.oidc.user.name}
    
Email: ${req.oidc.user.email}
    
${JSON.stringify(req.oidc.user, null, 2)}
    Logout
  );
});
// Login/logout links
app.get('/', (req, res) => {
  res.send(
    ${req.oidc.isAuthenticated() ? 
      
Welcome, ${req.oidc.user.name}!
      Profile
      Logout
     : 
      Login
    }
  );
});

5. Test Authentication

Start your server:

node app.js

Visit http://localhost:3000 and test the login flow.

Detailed Documentation

Common Mistakes

| Mistake | Fix | |---------|-----| | Forgot to add callback URL in Auth0 Dashboard | Add /callback path to Allowed Callback URLs (e.g., http://localhost:3000/callback) | | Missing or weak SECRET | Generate secure secret with openssl rand -hex 32 and store in .env as SECRET | | Setting authRequired: true globally | Set to false and use requiresAuth() middleware on specific routes | | App created as SPA type in Auth0 | Must be Regular Web Application type for server-side auth | | Session secret exposed in code | Always use environment variables, never hardcode secrets | | Wrong baseURL for production | Update BASE_URL to match your production domain | | Not handling logout returnTo | Add your domain to Allowed Logout URLs in Auth0 Dashboard |

Related Skills

Quick Reference

Middleware Options:

Request Properties:

Common Use Cases:

References