Install and verify

Before you start

The package does not declare an engine requirement. Use a maintained Node.js release appropriate to your host application.

Use a project with a package.json. Check the runtime and package manager:

1node --version
2npm --version

Install the documented version

1npm install @qentrah/auth-sdk@0.3.4

Confirm the installation

1npm ls @qentrah/auth-sdk

The output should show @qentrah/auth-sdk@0.3.4. Commit the lockfile so another developer installs the same dependency tree.

Environment Variables

Use your own secret manager, hosting provider settings, or deployment environment.

1QENTRAH_WORKSPACE_BASE_URL=https://app.qentrah.com
2QENTRAH_PARTNER_CLIENT_ID=<your-partner-client-id>
3QENTRAH_PARTNER_CLIENT_SECRET=<optional-confidential-client-secret>
4QENTRAH_PARTNER_REDIRECT_URI=https://your-app.example.com/api/qentrah/oauth/callback
5QENTRAH_PARTNER_SCOPES="organization:read client:read"
6QENTRAH_WEBHOOK_SIGNING_SECRET=<your-webhook-signing-secret>

QENTRAH_PARTNER_CLIENT_SECRET is only needed for confidential client setups. Never place it in browser-visible configuration.

You can normalize the public OAuth settings with:

1import { qentrahPartnerAuthorityFromEnv } from "@qentrah/auth-sdk/partner";
2 
3const authority = qentrahPartnerAuthorityFromEnv({
4  QENTRAH_WORKSPACE_BASE_URL: process.env.QENTRAH_WORKSPACE_BASE_URL,
5  QENTRAH_PARTNER_CLIENT_ID: process.env.QENTRAH_PARTNER_CLIENT_ID,
6  QENTRAH_PARTNER_REDIRECT_URI: process.env.QENTRAH_PARTNER_REDIRECT_URI,
7  QENTRAH_PARTNER_SCOPES: process.env.QENTRAH_PARTNER_SCOPES,
8});

Browser Connect Button

1<button id="qentrah-authorize">Authorize with Qentrah</button>

1import { mountQentrahAuthorizeButton } from "@qentrah/auth-sdk/partner/browser";
2 
3mountQentrahAuthorizeButton({
4  buttonId: "qentrah-authorize",
5  startUrl: "/api/qentrah/oauth/start",
6  label: "Authorize with Qentrah",
7  disabledLabel: "Opening...",
8  onError(error) {
9    reportConnectionError(error);
10  },
11});

The button should point at a backend route in your app. It should not receive tokens or secrets.

Expected result

The connect button opens your backend start route. It cannot complete authorization until you implement server-side state and token storage and register the callback URI.