osm-auth is an open source project. You can submit bug reports, help out,
or learn more by visiting our project page on GitHub:
https://github.com/osmlab/osm-auth
Please star our project on GitHub to show your support! ⭐️
Breaking changes, which may affect downstream projects, are marked with a
- Allow caller to get the access token via
getAccessToken()(#149) - Always use
newto instantiate the main class (#148, thanks @k-yle) - Fix links to GitHub issues (#145, thanks @tyrasd)
- Add better test for
localStorage(#144)
- Remove Web Crypto API checking code and references to
window(#139,#140, thanks @tom-konda) - Detect if user tried to deny access in popup, notify BroadcastChannel (#141, thanks @ENT8R)
- This project uses
bunnow for simpler developer tooling (#142)
- Fix authentication broken when using the
popupmethod due to security changes on 8 July 2025 (#138, thanks @k-yle)
- Trigger error if popup is closed prematurely (#135, thanks @tyrasd)
- First-class support for switching users (#136, thanks @k-yle)
- Remove any extra quotes that were stored with legacy tokens (#129)
- Allow locale to be passed to login page (#23, #130, thanks @k-yle)
- Remove
storedependency (#126) - Attempt to fix export errors from TypeScript declaration file (#124, #125, thanks @pietervdvn)
- Add
apiUrlproperty to support connecting to OSM API atapi.openstreetmap.org(#123, operations#951) - Fix popup on Safari when accessing WebCryptoAPI (#121, #122, thanks @tyrasd)
- Fix double wrapping of
Errorobject returned from authenticate (0f48eb88)
- Make the fetch wrapper more compatible with fetch (#117, #118)
- Implement PKCE for OAuth2 authentication (#114, thanks @tyrasd)
- Add fetch wrapper (#112, thanks @dschep)
- Simplify and document singlepage authentication (#113, thanks @dschep)
⚠️ Breaking change: This library is now focused on supporting OAuth 2.0 (#77, #93, thanks @HelNershingThapa!)⚠️ xhrandrawxhroptions have changed slightly - check docs if you are usingoptionswith custom headers.⚠️ osm-auth is marked as"type": "module"now⚠️ Replace browserify with esbuild for super fast build speed. Package outputs are now:"module": "./src/osm-auth.mjs"- ESM, works withimport"main": "./dist/osm-auth.cjs"- CJS bundle, works withrequire()"browser": "./dist/osm-auth.iife.js"- IIFE bundle, works in browser<script>tag- Not testing on older environments like Internet Explorer or ES5. No promises that this will work there.
- Improve documentation around the use of all functions, some returns have changed (#53)
- Remove ecstatic, to avoid deprecation warnings
- Test on Node 14, 16, 18
- Remove xtend, to avoid deprecation warnings
- Improve interaction with popup window (#67)
- Add function
bringPopupWindowToFront()
- Use HTTPS protocol by default for openstreetmap.org (#20)
- Bugfix: Properly sign requests that include a querystring (#17)
- Upgrade all dependencies
- xhr should return an XMLHttpRequest (#16)
- Update ohauth dependency
- Update xtend to fix unpublished object-keys
- Add prefix option for non-http://openstreetmap.org urls
- Strip querystring as well (#6)
- Reverse key and secret order to reflect osm.org ordering
- Update ohauth dependency
- Fix non-form-urlencoded POST parameters case (#11)
- Better failure mode if localStorage is paranoid/full (#10)
- Support querystring args
- Fix behavior with hash with nothing after it
- Update store dependency
- Update ohauth dependency
⚠️ Don't use a nested object for keys (#8)
- Update ohauth dependency (#7)
- Update docs,
.keys(),.url()