Kodinus / OAuth sampleReady to authenticate

Confidential Worker BFF · Authorization Code + PKCE

Two tokens. Two audiences.

This app keeps tokens in D1 and gives the browser only an opaque session cookie. The receipt shows which audience is checked at each trust boundary.

Log in with Kodinus
Login result → your BFFID tokenaud = CLIENT_ID
BFF credential → your APIAccess tokenaud = API_AUDIENCE

The sample requests openid profile email, so its session ends with the ten-minute access token. Add refresh-token rotation only when the application has a serialized, encrypted server-side refresh flow.