Support auth-less PKCE OAuth providers such as Lichess

[myrlund]

Some PKCE OAuth providers work without passing any secrets, notably Lichess.org (see relevant docs). This patch allows for simply omitting auth for such public implementations.

In case you'd like to see this in practice, here is an example Lichess provider configuration:

const Lichess: OAuthConfig<any> = {
  id: "lichess",
  name: "Lichess",
  type: "oauth",

  // PKCE is default, but we make it explicit and add CSRF 'state'
  checks: ["pkce", "state"],

  // Lichess OAuth endpoints
  authorization: {
    url: "https://lichess.org/oauth",
    params: {
      scope: "email:read",
    },
  },
  token: "https://lichess.org/api/token",
  userinfo: "https://lichess.org/api/account",

  // Public client (no client_secret)
  client: {
    token_endpoint_auth_method: "none",
  },

  // Lichess doesn't return OIDC claims; map to Auth.js User
  async profile(profile, tokens) {
    // profile from /api/account includes username; email requires a second call
    let email: string | undefined;
    try {
      const r = await fetch("https://lichess.org/api/account/email", {
        headers: {
          Authorization: `Bearer ${tokens.access_token}`,
          "Content-Type": "application/json",
        },
      });
      if (r.ok) {
        const data = await r.json();
        email = data?.email?.trim();
      }
    } catch {}

    return {
      id: profile.id,
      name: profile.username,
      email,
    };
  },

  // Configure your public client id. Lichess doesn’t have app registration; pick a stable string.
  clientId: process.env.LICHESS_CLIENT_ID!,
};

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Preview	Updated (UTC)
convex-auth-docs	Ready	Preview	Sep 16, 2025 9:21pm

[goody81]

Speak of leeches. Somebody's been stealing my work all this time. So keep an eye for stuff. That's close to this because no, you're not right. From day one i'm in live cheated install and from

[goody81]

And I would've left most of it open source. But they took it before I could even get it on