Express Quickstart
Use this guide to add ThunderID authentication to an Express app with sign-in, sign-out, and route protection.
What You Will Learn
- Create a new Express app
- Install the
@thunderid/expresspackage
- Add working sign-in and sign-out routes
- Protect routes and access the signed-in user
Prerequisites
- About 15 minutes
- Node.js installed on your system
- npm, yarn, or pnpm
- Your preferred code editor
Run ThunderID
Start a local ThunderID instance. Pick the method that works best for you:
Requires Node.js 18+
Full install guide →Once it's running, the console is available at https://localhost:8090.
Create an Application
Open the Console at https://localhost:8090/console, navigate to Applications, and click Add Application:
- Under Technology, select Express.
- Enter a name (e.g.
My Express App) and create an application. The rest of the settings can stay at their defaults. - Copy both the Client ID and Client Secret from the window that pops up. The Client ID can also be found in the General tab.
- Under General, add
http://localhost:3000/loginto the list of Authorized Redirect URIs.
Create an Express App
Create your new Node.js application:
npm
Yarn
pnpm
mkdir my-express-app
cd my-express-app
npm init -y
npm install express cookie-parser
mkdir my-express-app
cd my-express-app
yarn init -y
yarn add express cookie-parser
mkdir my-express-app
cd my-express-app
pnpm init
pnpm add express cookie-parser
Install the SDK and Dependencies
Install the ThunderID Express SDK:
- npm
- Yarn
- pnpm
npm install @thunderid/express
yarn add @thunderid/express
pnpm add @thunderid/express
Add Authentication Middleware and Routes
Create an index.js file with ThunderID middleware and auth routes:
const express = require('express');
const cookieParser = require('cookie-parser');
const {thunderID, handleSignIn, handleSignOut, protect} = require('@thunderid/express');
const app = express();
const port = 3000;
app.use(cookieParser());
app.use(express.json());
app.use(
thunderID({
baseUrl: 'https://localhost:8090',
clientId: '<your-client-id>',
clientSecret: '<your-client-secret>',
afterSignInUrl: 'http://localhost:3000/login',
afterSignOutUrl: 'http://localhost:3000/logout',
}),
);
app.get('/', (_req, res) => {
res.send('<a href="/protected">Go to protected page</a>');
});
app.get('/login', handleSignIn());
app.get('/logout', handleSignOut());
app.get(
'/protected',
protect((res) => res.redirect('/login')),
(_req, res) => {
res.send('You are signed in and can access this protected route.');
},
);
app.get('/me', protect(), async (req, res) => {
const user = await req.thunderIDAuth.getUserFromRequest(req);
res.json(user);
});
app.listen(port, () => {
console.log(`Server running on http://localhost:${port}`);
});
Replace <your-client-id> and <your-client-secret> with values from your ThunderID application. Make sure the authorized redirect URL in your application settings is set to http://localhost:3000/login.
Run Your App
Start the server:
- npm
- Yarn
- pnpm
node index.js
yarn node index.js
pnpm node index.js
Open http://localhost:3000/protected.
You should be redirected to ThunderID sign-in. After successful login, you'll return to your app and access the protected route. Then open http://localhost:3000/me to inspect the signed-in user profile.
You'll need a user to sign in with. If you haven't created one yet, open https://localhost:8090/console, navigate to Users, and add a test user with an email and password.
You should see the sign-in link. Click it to be redirected to the ThunderID-hosted sign-in page. After authenticating with your test user, you'll return to the app as a signed-in user.
