Strava Authorization Provider

Strava OAuth App

Register the Application

The first step is to create and register an OAuth App on the Strava developer console to obtain access to the user's resources.

1. Navigate to your Strava profile Settings and go to My API Application.
2. If you don't have an application yet, click Create Application.
3. Fill out the application details (Name, Category, Website).
4. For the Authorization Callback Domain, enter the domain that hosts the callback (e.g., localhost).
   • Note: Strava validates by domain, not a full URI, so localhost represents http://localhost:3000/auth/callback/strava.
   • (Make sure to replace localhost with your production domain when deploying)
5. Click Create.
6. On the application page, you can now copy your Client ID and Client Secret.

Installation

Install the package using a package manager like npm, pnpm, or yarn:

npm install @aura-stack/auth

Environment setup

Now, you must configure the environment variables required by Aura Auth, including the Strava credentials and the encryption secrets.

# Aura Secrets
AURA_AUTH_SECRET="your-32-byte-secret"
AURA_AUTH_SALT="your-32-byte-salt"

# Strava Credentials
AURA_AUTH_STRAVA_CLIENT_ID="your_strava_client_id"
AURA_AUTH_STRAVA_CLIENT_SECRET="your_strava_client_secret"

Configure the Auth Instance

Configure the createAuth instance inside an auth.ts file located at the root of your project. Ensure you explicitly export the handlers, api, and jose objects.

import { createAuth } from "@aura-stack/auth"

export const auth = createAuth({
  oauth: ["strava"],
})

// Extract the required utilities
export const { handlers, api, jose } = auth

Customizing the OAuth Provider

If you need to define custom scopes, change the response type, or map profile data differently, you can use the provider's factory function instead of a simple string identifier.

import { createAuth } from "@aura-stack/auth"
import { strava } from "@aura-stack/auth/oauth/strava"

export const auth = createAuth({
  oauth: [
    strava({
      authorize: {
        params: {
          // Override default scopes
          scope: "read,profile:read_all",
        },
      },
    }),
  ],
})

export const { handlers, api, jose } = auth

Sign In to Strava (Client & Server)

There are multiple ways to trigger the sign-in flow depending on your ecosystem.

Sign-in Path (Direct Navigation)

The common route to trigger the auth flow natively without needing a client library is simply navigating the browser to: http://localhost:3000/auth/signIn/strava

Client-Side (React, Vue, etc.)

You can utilize the createAuthClient utility to programmatically trigger sign-ins. You can also define a redirectTo destination.

import { createAuthClient } from "@aura-stack/auth/client"

export const authClient = createAuthClient({
  baseURL: "http://localhost:3000/auth",
})

const triggerSignIn = async () => {
  await authClient.signIn("strava", {
    redirectTo: "/dashboard",
  })
}

Server-Side (Next.js Actions, Remix Loaders, etc.)

For environments supporting server-side actions, use the programmatic api.signIn method securely.

import { api } from "./auth"

export const serverSignIn = async () => {
  const response = await api.signIn("strava", {
    redirectTo: "http://localhost:3000/dashboard",
  })

  // Example returning redirect location
  return response.headers.get("Location")
}

Session Retrieval

After a user successfully signs in, you can retrieve their session data securely.

Client-Side:

const session = await authClient.getSession()
console.log(session?.user) // The authenticated user profile

Server-Side:

// Note: You must pass the native Web Request object or Headers!
const session = await api.getSession(request)
console.log(session?.user) // Safely retrieved backend session