---
title: "Secure Your Express App with OAuth 2.0, OIDC, and PKCE"
description: "Building authentication from scratch is risky and time-consuming, so the tutorial integrates Okta with an Express application using Passport, openid-client, OAuth 2.0, and OpenID Connect (OIDC). It creates a role-based expense dashboard in which users view spending data for their assigned teams, with team membership mapped from the email claim in the ID token. The setup uses Authorization Code Flow with PKCE, defined in RFC 7636, alongside express-session, EJS views, environment variables, and Okta redirect URI configuration. The sample project includes routes for login, logout, dashboard, profile, and team-specific expenses, while the running app displays these authenticated views. It concludes that OIDC supplies the identity layer over OAuth 2.0 and presents PKCE as a security baseline for server-side and browser-based web applications."
---

# Secure Your Express App with OAuth 2.0, OIDC, and PKCE

[Okta](https://yomu.fyi/company/okta) · Akanksha Bhasin · Jul 28, 2025

**Type:** Tutorial

## Summary

Building authentication from scratch is risky and time-consuming, so the tutorial integrates Okta with an Express application using Passport, openid-client, OAuth 2.0, and OpenID Connect (OIDC). It creates a role-based expense dashboard in which users view spending data for their assigned teams, with team membership mapped from the email claim in the ID token. The setup uses Authorization Code Flow with PKCE, defined in RFC 7636, alongside express-session, EJS views, environment variables, and Okta redirect URI configuration. The sample project includes routes for login, logout, dashboard, profile, and team-specific expenses, while the running app displays these authenticated views. It concludes that OIDC supplies the identity layer over OAuth 2.0 and presents PKCE as a security baseline for server-side and browser-based web applications.

## Context

Building authentication systems involves handling credentials, sessions, and tokens and is described as risky and time-consuming. The dashboard also needs to restrict expense visibility according to each user’s team and role.

## Approach / What changed

The tutorial configures an Okta OIDC web application and connects it to Express through Passport and openid-client. It uses Authorization Code Flow with PKCE, server-side sessions, EJS templates, and an email-to-team mapping from the ID token to filter displayed expenses.

## Takeaways

- PKCE, defined in RFC 7636, is used with the OAuth 2.0 Authorization Code flow to help prevent CSRF and authorization code injection attacks.
- The application maps each user’s email claim from the ID token to a team and filters expenses so users see only their department’s spending.
- The project uses Express 5.1, Passport 0.7, openid-client 6.6, express-session 1.18, EJS 3.1, and environment variables for Okta configuration.

**Tags:** [Authentication](https://yomu.fyi/topic/authentication), [Express](https://yomu.fyi/topic/express), [OAuth 2.0](https://yomu.fyi/topic/oauth-2-0), [OpenID Connect](https://yomu.fyi/topic/openid-connect)

- Source: [Okta](https://developer.okta.com/blog/2025/07/28/express-oauth-pkce)
- Source URL: https://developer.okta.com/blog/2025/07/28/express-oauth-pkce
- Ingested by Yomu: 2026-09-09T08:43:56.325Z

[Read original post](https://developer.okta.com/blog/2025/07/28/express-oauth-pkce)