Passport
passport-streamvi connects StreamVi to a Node.js server application through Passport. It exchanges an authorization code for a token; use SDK Axios, SDK Fetch or a regular HTTP client for subsequent API requests.
Installation
Install the fixed strategy from GitHub. npm builds the package during installation; keep package-lock.json in your application:
npm install passport git+https://github.com/StreamVi/passport-streamvi.gitThe state and PKCE verification fix has been merged into the main branch. The old npm release 1.0.6 does not include it. The GitHub installation above includes the fix without depending on a new npm release.
For TypeScript, also install the type declarations:
npm install --save-dev @types/passport @types/nodeConnection setup
Passport needs an OAuth application, client ID, secret, exact callback address and server session. Keep the secret in server environment variables. Your application must configure session and Passport middleware, a connection route, a callback handler and result storage. Registering StreamViStrategy alone is insufficient.
Enable state: true and pkce: true when creating StreamViStrategy. Add express-session middleware before passport.initialize(): the Passport store retains the single-use state and PKCE verifier between redirects. Do not pass your own string state to passport.authenticate, which would bypass the store. In the callback handler, session: false disables only Passport user serialization; the server OAuth session is still required.
The strategy README contains a complete Express example with connection routes and result storage. The SDK server example is an alternative without Passport.
Connection result
After a successful exchange, the strategy passes this user object to Passport:
| Field | Contents |
|---|---|
accessToken | API token for the selected project |
projectId | Internal project ID; validate and convert it before passing it as a numeric API parameter |
projectExternalId | External project ID |
With standard Passport middleware, the object is in req.user. With a custom callback passport.authenticate('streamvi', (error, user) => ...), read user.accessToken. The library does not create req.accessToken.
A successful exchange calls success(user) directly. The verification callback passed to the constructor is not called on this path, no user profile is loaded and no refreshToken is returned. Save the connection in the successful authentication handler and inspect the actual result, rather than expecting a profile from older README examples.
Callback validation
The fixed strategy starts code exchange only after successful state-store verification. With PKCE it supplies the saved code_verifier. Store errors and missing, mismatched or reused state stop the exchange. Asynchronous stores are also supported.
In the old npm release 1.0.6, the overridden callback skipped standard state verification and did not pass code_verifier. Setting state: true or pkce: true alone is insufficient in that release. If it is still installed, update to the fixed GitHub code or use direct OAuth with PKCE.
StreamVi's current OAuth contract does not support refresh_token exchange. Lost access requires renewed user consent. Do not expose the secret, token or complete connection result in the browser or public logs.