Central OAuth
A centralized OAuth 2.0 and OpenID Connect-inspired account security service with social login, MFA, passkeys, session management, and account recovery.
Project overview
A React and Vite account-management client connected to an Express 5 and TypeScript API, with PostgreSQL and Prisma persistence for accounts, sessions, tokens, MFA, passkeys, and audit-oriented security records.
Technology stack
Key features
- Registration and email verification
- Google and Apple authentication
- Access-token refresh and account sessions
- Password change and recovery flows
- Phone verification and profile updates
- Active-session listing and revocation
- Two-factor authentication with recovery codes
- WebAuthn passkey registration and sign-in
- reCAPTCHA and API rate limiting
- Audit-oriented login and security persistence
Design patterns & architecture
- OAuth 2.0 and OpenID Connect concepts
- Client-server separation
- Route-controller-service layering
- Prisma data access
- Middleware-based authentication and rate limiting
- Query caching with TanStack Query
Performance
The documented scope is functional rather than a claimed production benchmark; operational performance should be measured after deployment instrumentation.
React 19 client
Express 5 API
PostgreSQL persistence
Node.js 20+ runtime
Technical challenges
- Coordinating password, social, MFA, and passkey authentication paths
- Protecting account recovery and verification flows
- Managing sessions, refresh tokens, and revocation state
- Persisting useful security context without exposing credentials
- Keeping client account settings aligned with API state
Key lessons & insights
- Authentication is an account lifecycle, not only a login endpoint
- Passkeys and MFA provide complementary recovery and assurance options
- Session and audit records make security operations inspectable
- Provider redirects and trusted origins need explicit production configuration
The Problem
Pain Point
Applications need one coherent account-security experience across registration, verification, password recovery, social login, MFA, passkeys, sessions, and account deletion instead of separate fragile flows.
Industry Context
Modern products increasingly support OAuth providers, passwordless credentials, device sessions, and stronger account recovery while still needing a conventional email-and-password path.
User Impact
Users can manage identity and security from one account dashboard, while the API exposes organized routes for authentication, profiles, sessions, MFA, passkeys, and provider callbacks.
Constraints
- Protect password and token secrets outside source control
- Support Google and Apple authentication
- Handle email and phone verification
- Provide MFA and WebAuthn enrollment and recovery
- Allow users to revoke active sessions
- Persist audit-oriented security context without storing credentials in plaintext
Our approach
Solution
The React client provides account and security pages through React Router, Redux Toolkit, and TanStack Query. The Express API groups behavior under `/auth`, `/users/me`, `/sessions`, `/2fa`, `/passkeys`, provider-specific OAuth routes, and reCAPTCHA verification, with Prisma persisting the account and security model.
Key Decisions
- Use OAuth 2.0 and OpenID Connect concepts for provider-based authentication
- Keep authentication behavior behind server middleware and organized service layers
- Use Prisma migrations for explicit PostgreSQL schema history
- Support both TOTP-style MFA recovery and WebAuthn passkeys
- Use Winston for operational logging and persist login and session context for audit-oriented workflows
Trade-offs
- Supporting many authentication paths increases validation and recovery complexity
- Managed OAuth providers simplify sign-in but require trusted origins and redirect configuration
- Passkeys improve phishing resistance but require browser and device capability handling
- Detailed security records improve investigation but require careful data minimization and retention policies
Why Built This Way
Centralizing account lifecycle and security controls gives client applications one consistent contract while leaving room for stronger authentication methods than passwords alone.
Results & impact
Measurable Outcomes
Product Thinking
The useful unit is the complete account lifecycle: users can authenticate, verify, recover, secure, inspect, and close their account without switching security systems.
Value Proposition
One account-security service for registration, OAuth login, recovery, MFA, passkeys, sessions, and profile management.
Public Metrics
- 2 client/server applications: React client and Express API
- 7 documented API areas
- 2 social providers: Google and Apple
- 2 strong-authentication options: MFA and WebAuthn passkeys
- Node.js 20+ and PostgreSQL with Prisma
Case study
A user can register with validated account details, verify an email address, sign in with a password or Google or Apple, enroll MFA or a passkey, review active sessions, revoke another device, change account details, and recover access through the documented security flows.
Architecture Explained
The Vite React client renders account, security, OAuth callback, and recovery pages. React Router handles navigation, Redux Toolkit manages client state, and TanStack Query coordinates API data. The Express 5 server organizes routes, controllers, handlers, validation, middleware, and services. Prisma migrations persist PostgreSQL models for users, sessions, refresh tokens, verification tokens, MFA credentials, passkeys, login activity, failed attempts, IP addresses, and user agents. Nodemailer supports email flows, SimpleWebAuthn handles passkeys, and Winston provides logging.
Purpose & Vision
Provide a central, extensible account-security service that treats authentication, recovery, sessions, and stronger credentials as one product surface.
Clarity & Proof
The project is grounded in documented functionality rather than invented production outcomes: React 19 and Vite client, Express 5 API, PostgreSQL and Prisma persistence, Google and Apple login, MFA, WebAuthn passkeys, session revocation, reCAPTCHA, rate limiting, and audit-oriented records.
Future Improvements
- Add instrumented latency, error-rate, and authentication-success dashboards
- Add automated end-to-end coverage for every provider and recovery path
- Define token and audit-record retention policies
- Add additional OAuth providers where product requirements justify them
- Document deployment runbooks for migrations, backups, trusted origins, and secret rotation
Interested in working together?
Let's create something amazing. Get in touch to discuss your next project.
Go back to all projectsGo to all blog postsContact