What it is
This module handles the full lifecycle of linking third-party provider accounts (Twitch, Discord, Google, GitHub, Spotify) to SpacetimeDB identities. It lives inside your SpacetimeDB module and acts as both the authorization coordinator and the token vault, so no separate auth server is needed.
Where it fits
- Live streaming apps: A Twitch-integrated overlay or dashboard that needs to read a viewer's followed channels or subscriptions on their behalf.
- Social or community tools: A Discord-connected app where users link their Discord identity to unlock roles, read guild data, or post messages through the module.
- Multi-provider identity systems: Apps that let users connect several accounts (Google for calendar, Spotify for music, GitHub for repos) all under one SpacetimeDB identity.
- Any app where token security matters: Projects that previously stored access tokens in public tables or on the client and need a drop-in replacement that keeps tokens private.
- Cross-language teams: Projects where the server module might be rewritten or maintained in Rust, C#, or TypeScript, and a consistent schema across all three avoids client changes.
How it works
When a user wants to link an account, the module generates a short-lived, identity-bound authorization request and hands the browser a URL to open at the provider. The provider redirects back to a callback page hosted by the module, but that page does not process tokens directly. Instead, it passes the authorization code back to the browser, which then calls the module over its own authenticated connection to complete the link. This design means the code always lands in the hands of the identity that started the flow, so a tricked or phished link cannot attach someone else's account to an attacker.
Access and refresh tokens are stored in private tables that clients cannot read directly. What clients see is a view of their own linked accounts showing the provider name, external username, granted scopes, and token status. The module also runs a background process that refreshes tokens before they expire, using a lease to prevent multiple concurrent refreshes from conflicting when a provider rotates refresh tokens. When your own reducers need to call a provider API, a helper handles checking freshness, refreshing if needed, and retrying once on an authorization failure.
The module is distributed as a single drop-in file for Rust and C#, and as an npm package for TypeScript server modules. All three share the same table schema and protocol, so a browser client written against one works with any of them. Configuration is passed at publish time as environment variables, covering the callback base URL, allowed app origins, and per-provider credentials.
