mirror of
https://github.com/immich-app/immich
synced 2026-08-15 13:03:57 +00:00
5ba3446fdf
Immich's OAuth flow never sent a `nonce`, so oauth4webapi's default `expectNoNonce` rejected any id_token carrying one. Providers that inject a nonce on federated logins (e.g. AWS Cognito relaying Google) therefore broke with OAUTH_JWT_CLAIM_COMPARISON_FAILED: unexpected ID Token "nonce" claim. Generate a real nonce in authorize(), round-trip it (web via httpOnly cookie, mobile via the callback DTO since the client generates its own state/PKCE), and pass it as expectedNonce to authorizationCodeGrant so the value is verified per the OIDC spec. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| .npmignore | ||
| package.json | ||
| README.md | ||
| tsconfig.json | ||
@immich/sdk
A TypeScript SDK for interfacing with the Immich API.
Install
npm i --save @immich/sdk
Usage
For a more detailed example, check out the @immich/cli.
import { getAllAlbums, getMyUser, init } from "@immich/sdk";
const API_KEY = "<API_KEY>"; // process.env.IMMICH_API_KEY
init({ baseUrl: "https://demo.immich.app/api", apiKey: API_KEY });
const user = await getMyUser();
const albums = await getAllAlbums({});
console.log({ user, albums });